# incident

plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:25:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:25:37 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59888: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.34.237.45
country_id: 285570
description:
2026-02-02 17:26:47 dovecot_plain authenticator failed for H=(rerangs) [37.34.237.45]:57564: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:26:02 dovecot_login authenticator failed for H=(VGz7dk) [165.154.252.84]:52603: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2026-02-02 17:26:50 dovecot_plain authenticator failed for H=c-76-157-219-158.hsd1.il.comcast.net (super) [76.157.219.158]:60446: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:26:12 dovecot_login authenticator failed for H=(fdyYM350V) [165.154.235.122]:55224: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:26:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53927: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:26:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 17:26:12 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39246: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 17:26:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:27:17 dovecot_login authenticator failed for H=(GXdmb9l) [165.154.252.84]:50797: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:27:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64426: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.249.76.221
country_id: 1269750
description:
2026-02-02 17:28:00 dovecot_login authenticator failed for H=(static-221.76.249.49-tataidc.co.in) [49.249.76.221]:50760: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:27:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:27:10 dovecot_login authenticator failed for H=(ZDKqCDfUVz) [165.154.235.122]:54771: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.91.103.202
country_id: 6252001
description:
2026-02-02 17:27:11 dovecot_plain authenticator failed for H=c-24-91-103-202.hsd1.ma.comcast.net (ceste) [24.91.103.202]:43054: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:28:32 dovecot_login authenticator failed for H=(LlNNTp) [165.154.252.84]:56119: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2026-02-02 17:28:13 dovecot_plain authenticator failed for H=(inging) [65.20.184.80]:34563: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/druma/private-residence.php||SC:/home/indfinitydesign/public_html/images/druma||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 17:28:25 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55810: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:28:10 dovecot_login authenticator failed for H=(4E9PeZRi) [165.154.235.122]:61965: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:28:13 dovecot_login authenticator failed for H=(qgzVc2OYj) [165.154.252.84]:51289: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.203
country_id: 1835841
description:
2026-02-02 17:28:14 dovecot_login authenticator failed for H=([218.156.93.203]) [218.156.93.203]:57665: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:28:15 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65231: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:29:10 dovecot_login authenticator failed for H=(akkELN) [165.154.235.122]:60333: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:29:10 dovecot_login authenticator failed for H=(DEaCCw) [165.154.252.84]:63287: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2026-02-02 17:29:39 dovecot_plain authenticator failed for H=c-73-183-74-177.hsd1.pa.comcast.net (mucull) [73.183.74.177]:37964: 535 Incorrect authentication data (set_id=mhisham.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2026-02-02 17:29:53 dovecot_plain authenticator failed for H=c-68-52-119-193.hsd1.tn.comcast.net (moutcoic) [68.52.119.193]:41666: 535 Incorrect authentication data (set_id=admin@tst-ma.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:29:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61153: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 17:30:01 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:50936: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:30:47 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 17:30:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:50936: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:30:09 dovecot_login authenticator failed for H=(xgMRNiW5Z) [165.154.235.122]:55530: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 17:30:39 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46108: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:30:06 dovecot_login authenticator failed for H=(HAMPcxfzb) [165.154.252.84]:58581: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:30:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56101: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:31:09 dovecot_login authenticator failed for H=(wK3cIkFk) [165.154.235.122]:50484: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:31:02 dovecot_login authenticator failed for H=(mbvBquDi) [165.154.252.84]:53912: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:31:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65307: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:31:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.205.115.105
country_id: 1819730
domain: pftfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/pftfood/public_html/wp-includes/images/wp-login.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2026-02-02 17:32:42 dovecot_login authenticator failed for H=(228.pool90-161-217.static.orange.es) [90.161.217.228]:48702: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2026-02-02 17:32:42 dovecot_plain authenticator failed for H=c-98-193-112-85.hsd1.il.comcast.net (rably) [98.193.112.85]:60588: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 17:32:51 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50370: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:32:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58920: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2026-02-02 17:32:11 dovecot_plain authenticator failed for H=(astathers) [65.20.129.28]:50187: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.49.26
country_id: 226074
description:
2026-02-02 17:32:43 dovecot_login authenticator failed for H=([196.0.49.26]) [196.0.49.26]:44460: 535 Incorrect authentication data (set_id=contact@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 17:32:45 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (rhotous) [87.103.126.54]:23102: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:32:54 dovecot_login authenticator failed for H=(SXxhhyPdMW) [165.154.252.84]:62216: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 17:32:33 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah@mckd.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.237.57.61
country_id: 2017370
description:
2026-02-02 17:32:57 dovecot_login authenticator failed for H=host-85-237-57-61.dsl.sura.ru [85.237.57.61]:38956: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-02-02 17:32:22 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:41184: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:32:16 dovecot_login authenticator failed for H=(Jhaep0yQ) [165.154.252.84]:55149: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.126.129.201
country_id: 1835841
description:
2026-02-02 17:32:33 dovecot_login authenticator failed for H=([168.126.129.201]) [168.126.129.201]:40858: 535 Incorrect authentication data (set_id=contact@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:32:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:32:09 dovecot_login authenticator failed for H=(eqz5NwUZ1) [165.154.235.122]:49233: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:33:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:33:09 dovecot_login authenticator failed for H=(WpVCaZ5b) [165.154.235.122]:55262: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 17:33:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah@mckd.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:33:13 dovecot_login authenticator failed for H=(tpxg6Mr) [165.154.252.84]:49593: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:33:36 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55939: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.192.99.189
country_id: 1814991
description:
2026-02-02 17:34:18 dovecot_login authenticator failed for H=([127.0.0.1]) [220.192.99.189]:40434: 535 Incorrect authentication data (set_id=inf)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:34:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 17:34:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah@mckd.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:34:09 dovecot_login authenticator failed for H=(4nom5i) [165.154.235.122]:50961: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.86
country_id: 1269750
description:
2026-02-02 17:34:45 dovecot_login authenticator failed for H=([182.95.22.208]) [125.23.228.86]:34700: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.68.7.227
country_id: 1814991
description:
2026-02-02 17:34:09 dovecot_login authenticator failed for H=([127.0.0.1]) [223.68.7.227]:50060: 535 Incorrect authentication data (set_id=inf@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:34:10 dovecot_login authenticator failed for H=(DrVSEpI) [165.154.252.84]:61400: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:34:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53301: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 17:35:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah@mckd.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:35:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64398: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 17:36:00 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:50680: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-02-02 17:35:13 dovecot_login authenticator failed for H=([196.189.59.227]) [196.189.59.226]:48906: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:35:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 17:35:06 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54002: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:35:07 dovecot_login authenticator failed for H=(tm6VanZh1) [165.154.252.84]:59045: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:35:08 dovecot_login authenticator failed for H=(AR5OYzZ) [165.154.235.122]:50932: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-02 17:36:26 H=([167.148.167.71]) [167.148.167.71]:58150 F=<Suport@tujusetia.my> rejected RCPT <layhun.yeoh@tujusetia.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:36:04 dovecot_login authenticator failed for H=(aIuQrCfev) [165.154.252.84]:54480: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:36:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58448: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:36:09 dovecot_login authenticator failed for H=(zn59QCrHqY) [165.154.235.122]:62480: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 17:36:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah@mckd.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:37:19 dovecot_login authenticator failed for H=(4qrdtUaJ0b) [165.154.252.84]:58465: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:37:38 dovecot_login authenticator failed for H=(GmWg6EK) [165.154.252.84]:60977: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:37:07 dovecot_login authenticator failed for H=(jhXnHWNuoB) [165.154.235.122]:56502: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:37:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52257: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.187
country_id: 690791
description:
2026-02-02 17:37:13 H=([77.83.39.187]) [77.83.39.187]:50800 F=<lilian@baseballrolin.com> rejected RCPT <boonpau.tan@tujusetia.my>: No such person at this address."


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 17:37:15 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57832: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:39:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:38:06 dovecot_login authenticator failed for H=(B0276nl) [165.154.235.122]:60179: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:38:16 dovecot_login authenticator failed for H=(ds3gIG3j) [165.154.252.84]:54815: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:38:17 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64028: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:39:03 dovecot_login authenticator failed for H=(3YSt2d2c) [165.154.235.122]:51802: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:39:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57591: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 17:39:26 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47902: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.205.8.251
country_id: 1819730
domain: mail.mokshana.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/mokshanacom/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:39:13 dovecot_login authenticator failed for H=(lzXcVSoHfW) [165.154.252.84]:49223: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 17:39:18 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:60025: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:39:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:40:19 dovecot_login authenticator failed for H=(p7HxqLkja) [165.154.235.122]:63123: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-02 17:40:22 H=([167.148.167.71]) [167.148.167.71]:59102 F=<Suport@tujusetia.my> rejected RCPT <zainab@tujusetia.my>: Sender verify failed


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:40:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 17:40:27 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah@mckd.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:40:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63535: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:40:10 dovecot_login authenticator failed for H=(ErfzC3k) [165.154.252.84]:59421: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 8.219.115.240
country_id: 1880251
description:
[2026-02-02 17:41:05 +0800] info [cpaneld] 8.219.115.240 - mckd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:41:07 dovecot_login authenticator failed for H=(a2JnuQ) [165.154.252.84]:52173: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:41:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.93.205
country_id: 1668284
description:
2026-02-02 17:41:55 dovecot_login authenticator failed for H=110-25-93-205.adsl.fetnet.net [110.25.93.205]:59383: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 17:41:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah@mckd.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:41:17 dovecot_login authenticator failed for H=(iwwkYhDtQ9) [165.154.235.122]:56519: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 17:41:35 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:58970: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:41:36 dovecot_login authenticator failed for H=(i4TGkklW) [165.154.235.122]:49961: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:41:38 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52271: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:42:21 dovecot_login authenticator failed for H=(Z7pIsi) [165.154.252.84]:54135: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:42:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50735: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.29.136
country_id: 2017370
description:
2026-02-02 17:42:08 dovecot_login authenticator failed for H=([31.173.29.136]) [31.173.29.136]:45554: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:42:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:42:14 dovecot_login authenticator failed for H=(5gEtq9C) [165.154.235.122]:52200: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 17:42:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah@mckd.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.71.84.38
country_id: 3469034
description:
2026-02-02 17:43:24 dovecot_login authenticator failed for H=([200.71.84.38]) [200.71.84.38]:38270: 535 Incorrect authentication data (set_id=office@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:43:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62580: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:43:11 dovecot_login authenticator failed for H=(fSK0LdW) [165.154.235.122]:50311: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:43:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.187.7.14
country_id: 1835841
description:
2026-02-02 17:43:33 dovecot_login authenticator failed for H=([211.187.7.14]) [211.187.7.14]:56597: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 17:43:43 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41798: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.2.182
country_id: 2017370
description:
2026-02-02 17:43:21 dovecot_login authenticator failed for H=([31.173.2.182]) [31.173.2.182]:56534: 535 Incorrect authentication data (set_id=office@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:43:17 dovecot_login authenticator failed for H=(8iMAMCxjiB) [165.154.252.84]:50791: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 17:43:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah@mckd.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.53.19
country_id: 1643084
description:
2026-02-02 17:43:28 dovecot_login authenticator failed for H=([103.138.53.19]) [103.138.53.19]:35661: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:44:08 dovecot_login authenticator failed for H=(KeHLetWQB) [165.154.235.122]:55343: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:44:14 dovecot_login authenticator failed for H=(ksf6EHE5yh) [165.154.252.84]:64196: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.187
country_id: 690791
description:
2026-02-02 17:44:14 H=([77.83.39.187]) [77.83.39.187]:50723 F=<lilian@baseballrolin.com> rejected RCPT <mkadmin@mkmetal.com.my>: No Such User Here"


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 17:44:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah@mckd.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:44:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57223: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.168.47.5
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=46961516585695 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:45:09 dovecot_login authenticator failed for H=(xTxSaXM1) [165.154.252.84]:60603: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:45:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49649: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:45:47 dovecot_login authenticator failed for H=(NEABN07tlr) [165.154.252.84]:52609: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:45:06 dovecot_login authenticator failed for H=(GxdM8b9k) [165.154.235.122]:55801: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 34.52.219.24
country_id: 2802361
description:
2026-02-02 17:45:25 303441 [Warning] Aborted connection 303441 to db: 'unconnected' user: 'unauthenticated' host: '34.52.219.24' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 17:45:52 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44734: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 17:45:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah@mckd.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:46:05 dovecot_login authenticator failed for H=(gDU47yc) [165.154.235.122]:54434: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:46:06 dovecot_login authenticator failed for H=(aX898SPHvT) [165.154.252.84]:56957: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:46:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59564: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:47:00 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:47:21 dovecot_login authenticator failed for H=(VdDxU0) [165.154.235.122]:60585: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:47:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54599: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:47:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:47:21 dovecot_login authenticator failed for H=(N5uCfWI9) [165.154.252.84]:59397: 535 Incorrect authentication data (set_id=norazizah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 17:47:59 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:45100: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 40.74.73.245
country_id: 1861060
domain: af-sb.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/afsb/public_html/wp-includes/images/wp-login.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:48:17 dovecot_login authenticator failed for H=(eO0Ellb) [165.154.252.84]:56868: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:48:19 dovecot_login authenticator failed for H=(PXJqW3Qu) [165.154.235.122]:64511: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:48:15 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49431: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:48:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.119.165
country_id: 1733045
description:
2026-02-02 17:49:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.119.165]:24828: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:49:13 dovecot_login authenticator failed for H=(yowyNcyaq) [165.154.252.84]:53597: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:49:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:49:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61305: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:49:16 dovecot_login authenticator failed for H=(IqpNIZAP) [165.154.235.122]:51415: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.119.165
country_id: 1733045
description:
2026-02-02 17:51:01 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.119.165]:50244: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 17:50:08 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:37358: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:50:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.160.71
country_id: 6252001
description:
2026-02-02 17:50:14 dovecot_login authenticator failed for H=([127.0.0.1]) [70.174.160.71]:43847: 535 Incorrect authentication data (set_id=inf@mckd.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:50:10 dovecot_login authenticator failed for H=(SiEDL9kg5c) [165.154.252.84]:50972: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:50:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58638: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:50:14 dovecot_login authenticator failed for H=(HoGmWU2k) [165.154.235.122]:58956: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.205.16.34
country_id: 226074
description:
2026-02-02 17:50:22 dovecot_login authenticator failed for H=([127.0.0.1]) [129.205.16.34]:34718: 535 Incorrect authentication data (set_id=inf)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:50:28 dovecot_login authenticator failed for H=(pHHay9xS) [165.154.252.84]:55581: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:51:06 dovecot_login authenticator failed for H=(oiYGga) [165.154.252.84]:65393: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:51:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58011: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.119.165
country_id: 1733045
description:
2026-02-02 17:51:07 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.119.165]:50244: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:51:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:51:11 dovecot_login authenticator failed for H=(Xoye8gv) [165.154.235.122]:63228: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 17:51:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:52:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61451: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 17:52:32 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50680: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:52:02 dovecot_login authenticator failed for H=(PUEwCDN) [165.154.252.84]:52606: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 17:52:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:52:08 dovecot_login authenticator failed for H=(Myufyc0Sn) [165.154.235.122]:63977: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.241.254.41
country_id: 1814991
description:
2026-02-02 17:52:17 dovecot_login authenticator failed for H=([127.0.0.1]) [183.241.254.41]:49126: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.145.135.186
country_id: 1814991
description:
2026-02-02 17:52:26 dovecot_login authenticator failed for H=([127.0.0.1]) [14.145.135.186]:55386: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 17:53:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:53:18 dovecot_login authenticator failed for H=(91V9lov1) [165.154.252.84]:59052: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:53:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57074: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.58.215.72
country_id: 1819730
description:
2026-02-02 17:53:35 dovecot_login authenticator failed for H=(ADMIN) [123.58.215.72]:49797: 535 Incorrect authentication data (set_id=yinfun_ng@usfood.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:53:05 dovecot_login authenticator failed for H=(2jJoUz1Bs) [165.154.235.122]:51135: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-02-02 17:53:15 dovecot_plain authenticator failed for H=(bunbugh) [24.187.213.29]:47804: 535 Incorrect authentication data (set_id=kendek@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:54:02 dovecot_login authenticator failed for H=(dexJDfAQb) [165.154.235.122]:52292: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:54:21 dovecot_login authenticator failed for H=(h0BI7R0j8) [165.154.235.122]:54146: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 17:54:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:54:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51446: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:54:14 dovecot_login authenticator failed for H=(1bj9ESW9L) [165.154.252.84]:58413: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 17:54:45 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:37740: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.37.198.190
country_id: 6252001
description:
2026-02-02 17:54:19 dovecot_login authenticator failed for H=(host190.covisint.com) [64.37.198.190]:60976: 535 Incorrect authentication data (set_id=sales@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.171.89.199
country_id: 1835841
description:
2026-02-02 17:54:23 dovecot_login authenticator failed for H=([223.171.89.199]) [223.171.89.199]:59880: 535 Incorrect authentication data (set_id=sales@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.228.164.236
country_id: 2017370
description:
2026-02-02 17:54:32 dovecot_login authenticator failed for H=([193.228.164.236]) [193.228.164.236]:44576: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:54:57 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 17:55:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:55:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62670: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:55:11 dovecot_login authenticator failed for H=(6ueeFdbG) [165.154.252.84]:54166: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:55:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:55:18 dovecot_login authenticator failed for H=(9WulgyuXz1) [165.154.235.122]:60612: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 123.110.169.47
country_id: 1668284
description:
Feb  2 17:56:25 sv3 pure-ftpd[2077866]: (?@123.110.169.47) [INFO] New connection from 123.110.169.47


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:56:08 dovecot_login authenticator failed for H=(j5RkFK7) [165.154.252.84]:52188: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:56:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65131: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 17:56:55 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:60840: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.235.192.130
country_id: 1835841
description:
2026-02-02 17:56:05 dovecot_login authenticator failed for H=([1.235.192.130]) [1.235.192.130]:45620: 535 Incorrect authentication data (set_id=contactus@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:56:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:56:16 dovecot_login authenticator failed for H=(NORkI7AT) [165.154.235.122]:54750: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2026-02-02 17:56:18 dovecot_login authenticator failed for H=(189-44-133-238.customer.tdatabrasil.net.br) [189.44.133.238]:46165: 535 Incorrect authentication data (set_id=contactus)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 123.110.169.47
country_id: 1668284
description:
Feb  2 17:56:30 sv3 pure-ftpd[2077866]: (?@123.110.169.47) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:57:04 dovecot_login authenticator failed for H=(65wqTUNc) [165.154.252.84]:55542: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:57:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 17:58:01 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:50971: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:57:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60020: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:57:13 dovecot_login authenticator failed for H=(3YEsHWSm) [165.154.235.122]:56527: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:58:39 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53788: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.2
country_id: 1269750
description:
2026-02-02 17:58:55 dovecot_login authenticator failed for H=([152.52.238.55]) [182.95.184.2]:48284: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:58:10 dovecot_login authenticator failed for H=(lSV0w5vD) [165.154.235.122]:51976: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 141.98.10.106
country_id: 597427
description:
2026-02-02 17:58:04 H=([141.98.10.106]) [141.98.10.106]:62760 F=<mselhime@drake-scruggs.com> rejected RCPT <suffian@pspoly.com.my>: SPF: 141.98.10.106 is not allowed to send mail from drake-scruggs.com


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:58:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:58:20 dovecot_login authenticator failed for H=(C3k44SxlqV) [165.154.252.84]:60868: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:58:38 dovecot_login authenticator failed for H=(KcTBuFF) [165.154.252.84]:65440: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 17:58:07 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:50971: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.122
country_id: 1269750
description:
2026-02-02 17:58:39 dovecot_login authenticator failed for H=([182.95.230.122]) [182.95.230.122]:56520: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 17:59:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 17:59:06 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:40608: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 17:59:07 dovecot_login authenticator failed for H=(eL2WA5V) [165.154.235.122]:62056: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 17:59:16 dovecot_login authenticator failed for H=(sVOUmpZ) [165.154.252.84]:58850: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 17:59:09 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:59249: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 17:59:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 17:59:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49503: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 18:00:04 dovecot_login authenticator failed for H=(nQZYqMT) [165.154.235.122]:65052: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:00:38 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61675: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 167.172.147.25
country_id: 6252001
description:
2026-02-02 18:00:55 304073 [Warning] Aborted connection 304073 to db: 'unconnected' user: 'unauthenticated' host: '167.172.147.25' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 167.172.144.69
country_id: 6252001
description:
2026-02-02 18:00:56 304074 [Warning] Aborted connection 304074 to db: 'unconnected' user: 'unauthenticated' host: '167.172.144.69' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 159.223.159.250
country_id: 6252001
description:
2026-02-02 18:00:56 304075 [Warning] Aborted connection 304075 to db: 'unconnected' user: 'unauthenticated' host: '159.223.159.250' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 18:00:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 18:00:12 dovecot_login authenticator failed for H=(jGWVpVd) [165.154.252.84]:57172: 535 Incorrect authentication data (set_id=norazizah)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 172.59.64.93
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/down/12/1237596 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.191.110.23
country_id: 6252001
description:
[2026-02-02 18:00:57 +0800] info [cpaneld] 73.191.110.23 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.76.125.80
country_id: 6252001
description:
[2026-02-02 18:01:00 +0800] info [cpaneld] 71.76.125.80 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.230.78.52
country_id: 6252001
description:
[2026-02-02 18:01:10 +0800] info [cpaneld] 97.230.78.52 - dscexp "GET /login/?login_only=1&user=dscexp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dscexp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.58.13.188
country_id: 6252001
description:
[2026-02-02 18:01:15 +0800] info [cpaneld] 98.58.13.188 - dsce "GET /login/?login_only=1&user=dsce&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dsce (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.50.167.81
country_id: 1269750
description:
2026-02-02 18:01:16 dovecot_login authenticator failed for H=([36.50.167.81]) [36.50.167.81]:34922: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.15.205.46
country_id: 6252001
description:
[2026-02-02 18:01:20 +0800] info [cpaneld] 70.15.205.46 - ds "GET /login/?login_only=1&user=ds&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ds (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.221.168
country_id: 6252001
description:
2026-02-02 18:01:25 dovecot_login authenticator failed for H=wsip-70-183-221-168.br.br.cox.net [70.183.221.168]:55728: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 18:01:09 dovecot_login authenticator failed for H=(Mjf1I9) [165.154.252.84]:52734: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.83.226
country_id: 6252001
description:
[2026-02-02 18:01:13 +0800] info [cpaneld] 172.59.83.226 - dscex "GET /login/?login_only=1&user=dscex&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dscex (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 18:01:17 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36704: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 18:01:21 dovecot_login authenticator failed for H=(hLgi6Tkun8) [165.154.235.122]:61285: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.178.117.149
country_id: 6252001
description:
[2026-02-02 18:01:04 +0800] info [cpaneld] 71.178.117.149 - dscexpatcom "GET /login/?login_only=1&user=dscexpatcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dscexpatcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.52.176.82
country_id: 6252001
description:
[2026-02-02 18:01:17 +0800] info [cpaneld] 98.52.176.82 - dsc "GET /login/?login_only=1&user=dsc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dsc (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:01:37 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63493: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.51.118.189
country_id: 3469034
description:
2026-02-02 18:01:38 dovecot_login authenticator failed for H=(189-51-118-65.rapeedo.net.br) [189.51.118.189]:60752: 535 Incorrect authentication data (set_id=contactus@manforce.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.184.88.135
country_id: 6252001
description:
[2026-02-02 18:01:02 +0800] info [cpaneld] 97.184.88.135 - dscexpat "GET /login/?login_only=1&user=dscexpat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 18:01:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.68.94.109
country_id: 6252001
description:
[2026-02-02 18:01:07 +0800] info [cpaneld] 74.68.94.109 - dscexpa "GET /login/?login_only=1&user=dscexpa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dscexpa (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.100.77
country_id: 1814991
description:
2026-02-02 18:02:00 dovecot_login authenticator failed for H=([111.26.100.77]) [111.26.100.77]:45892: 535 Incorrect authentication data (set_id=contactus)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 18:02:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 18:02:19 dovecot_login authenticator failed for H=(iVZwLR1ua) [165.154.235.122]:58614: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:02:32 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50694: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 18:02:57 dovecot_login authenticator failed for H=(ej6RfgwpEp) [165.154.235.122]:56999: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.231.138.201
country_id: 3469034
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/cwd/proc/self/cwd/etc/chrony.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 18:02:05 dovecot_login authenticator failed for H=(q80C5JpU) [165.154.252.84]:64521: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 18:02:55 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 18:03:29 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44190: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 18:03:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 18:03:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norazizah has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 18:03:20 dovecot_login authenticator failed for H=(UgXuduA7) [165.154.252.84]:63945: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 18:03:17 dovecot_login authenticator failed for H=(zmiE1k0zdq) [165.154.235.122]:60560: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:03:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65103: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 18:04:21 dovecot_login authenticator failed for H=(WQemP0zYbk) [165.154.235.122]:61817: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.205.115.105
country_id: 1819730
domain: garudabay.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/garudabay/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:04:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60350: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 18:04:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 18:04:06 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:49465: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 18:04:16 dovecot_login authenticator failed for H=(3RTrJYgDT) [165.154.252.84]:59834: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2026-02-02 18:05:15 dovecot_login authenticator failed for H=([62.220.236.203]) [62.220.236.203]:33372: 535 Incorrect authentication data (set_id=support@wohcheong.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 18:05:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.72.235.193
country_id: 2017370
description:
2026-02-02 18:05:17 dovecot_login authenticator failed for H=(4C5E0C0DE7C6.mldns.ru) [109.72.235.193]:55329: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:05:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55631: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.120.45
country_id: 732800
description:
2026-02-02 18:05:24 dovecot_login authenticator failed for H=(62-73-120-45.btc-net.bg) [62.73.120.45]:45381: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.104.50.190
country_id: 1562822
description:
2026-02-02 18:05:12 dovecot_login authenticator failed for H=(dynamic-adsl.viettel.vn) [116.104.50.190]:50450: 535 Incorrect authentication data (set_id=contactus@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 18:05:13 dovecot_login authenticator failed for H=(UCIop4koqE) [165.154.252.84]:53836: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 18:05:20 dovecot_login authenticator failed for H=(o7ksv1J) [165.154.235.122]:50621: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2026-02-02 18:05:23 dovecot_plain authenticator failed for H=(spint) [65.20.160.107]:34175: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.158
country_id: 1269750
description:
2026-02-02 18:05:27 dovecot_login authenticator failed for H=([182.95.26.52]) [182.95.185.158]:55304: 535 Incorrect authentication data (set_id=contactus)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.212.37.145
country_id: 1814991
description:
2026-02-02 18:05:29 dovecot_login authenticator failed for H=(145.37.212.118.adsl-pool.jx.chinaunicom.com) [118.212.37.145]:51085: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 18:06:20 dovecot_login authenticator failed for H=(TeA6jq) [165.154.235.122]:65376: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:06:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51694: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 18:06:29 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35894: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 18:06:10 dovecot_login authenticator failed for H=(HiIlgT) [165.154.252.84]:65486: 535 Incorrect authentication data (set_id=norazizah)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 18:06:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.203.117.99
country_id: 6251999
description:
2026-02-02 18:06:41 dovecot_login authenticator failed for H=99.117.203.35.bc.googleusercontent.com (10.162.0.2) [35.203.117.99]:59050: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 48.218.160.155
country_id: 1861060
domain: mail.tst-ma.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/tstmacom/public_html/wp-includes||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 18:07:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 18:07:40 dovecot_login authenticator failed for H=(8GWzgYe) [165.154.235.122]:61534: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:07:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64264: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 18:07:20 dovecot_login authenticator failed for H=(ZAsQKd) [165.154.235.122]:62594: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:08:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59481: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 18:08:22 dovecot_login authenticator failed for H=(7hSkhTE) [165.154.235.122]:57517: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 18:08:15 dovecot_login authenticator failed for H=(bsQyhmScwu) [69.5.189.21]:57707: 535 Incorrect authentication data (set_id=audrey@kendek.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 48.218.160.155
country_id: 1861060
domain: mail.wcc.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/woh/wcc.com.my/wp-includes/images/wp-login.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/services/survey-meter/images/sliders/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.41
country_id: 690791
description:
2026-02-02 18:08:30 H=([45.144.212.41]) [45.144.212.41]:51412 F=<sales@factmr.com> rejected RCPT <cklee@ktlog.com.my>: SPF: 45.144.212.41 is not allowed to send mail from factmr.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 18:09:26 dovecot_login authenticator failed for H=(USItinKC) [69.5.189.21]:53136: 535 Incorrect authentication data (set_id=audrey)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/demos/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:09:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52888: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 18:09:22 dovecot_login authenticator failed for H=(6wxoFcAH) [165.154.235.122]:54191: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 18:09:34 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54458: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/about-us/images/sliders/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/about-us||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 18:10:22 dovecot_login authenticator failed for H=(k6Y7OI) [165.154.235.122]:64372: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.161
country_id: 2750405
description:
2026-02-02 18:10:24 304567 [Warning] Aborted connection 304567 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.161' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 18:11:00 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:10:04 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64960: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 18:11:22 dovecot_login authenticator failed for H=(zKhVknwODO) [165.154.235.122]:63097: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/dosimeter.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:11:17 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60196: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 18:11:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:11:19 dovecot_login authenticator failed for H=(nSETlROd) [77.83.39.61]:49644: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 18:12:40 dovecot_login authenticator failed for H=(MTBME5) [165.154.235.122]:58529: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.18.67
country_id: 3469034
description:
2026-02-02 18:12:48 dovecot_login authenticator failed for H=(cyrela.static.gvt.net.br) [179.185.18.67]:38666: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2026-02-02 18:12:50 dovecot_plain authenticator failed for H=c-71-235-225-181.hsd1.ct.comcast.net (tessubst) [71.235.225.181]:41538: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:12:16 dovecot_login authenticator failed for H=(ZabKh9FNn) [77.83.39.61]:62341: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:12:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55971: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 18:12:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.80.185
country_id: 690791
description:
2026-02-02 18:12:29 dovecot_plain authenticator failed for H=(euper) [178.16.80.185]:41049: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.204.154.246
country_id: 1814991
description:
2026-02-02 18:12:26 dovecot_login authenticator failed for H=([121.204.154.246]) [121.204.154.246]:40990: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 18:12:21 dovecot_login authenticator failed for H=(0DrB2bTLN) [165.154.235.122]:63699: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 18:12:23 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52184: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 18:13:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 18:13:18 dovecot_login authenticator failed for H=(DhL7P9WGGZ) [165.154.235.122]:53475: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:13:11 dovecot_login authenticator failed for H=(AoFATjb9e) [77.83.39.61]:55265: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:13:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50728: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.161
country_id: 2750405
description:
2026-02-02 18:13:39 304694 [Warning] Aborted connection 304694 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.161' (This connection closed normally without authentication)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:13:46 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin@agsaintifik.com.my has been temporarily locked by Imunify PAM(77.83.39.61)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 18:14:02 +0800] info [cpaneld] 185.204.54.153 - laam "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user laam (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.80.233
country_id: 298795
description:
2026-02-02 18:14:03 dovecot_plain authenticator failed for H=(conic) [5.26.80.233]:40166: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:14:06 dovecot_login authenticator failed for H=(WPqfHS) [77.83.39.61]:51845: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:14:17 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62473: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.161
country_id: 2750405
description:
2026-02-02 18:14:53 304759 [Warning] Aborted connection 304759 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.161' (This connection closed normally without authentication)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:14:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin@agsaintifik.com.my has been temporarily locked by Imunify PAM(77.83.39.61)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.187
country_id: 690791
description:
2026-02-02 18:14:44 H=([77.83.39.187]) [77.83.39.187]:54761 F=<lilian@baseballrolin.com> rejected RCPT <stevenng@fkr.com.my>: Mail to stevenng@fkr.com.my has been suspended


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 18:14:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 18:14:16 dovecot_login authenticator failed for H=(4kv2yQJS) [165.154.235.122]:58072: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:15:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin@agsaintifik.com.my has been temporarily locked by Imunify PAM(77.83.39.61)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.213.242
country_id: 3469034
description:
2026-02-02 18:15:58 dovecot_login authenticator failed for H=([200.164.226.113]) [200.149.213.242]:55585: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 18:15:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 18:15:13 dovecot_login authenticator failed for H=(O74wX4ww) [165.154.235.122]:62414: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.114
country_id: 1269750
description:
2026-02-02 18:15:33 dovecot_login authenticator failed for H=(nsg-corporate-17.50.186.122.airtel.in) [182.95.61.114]:54840: 535 Incorrect authentication data (set_id=postmaster@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.200.108.13
country_id: 2589581
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/mockery/mockery/docs/reference/map.rst.inc HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 18:15:14 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53888: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:15:19 dovecot_login authenticator failed for H=(95yqTMzhGp) [77.83.39.61]:52395: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 197.200.108.13
country_id: 2589581
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/mockery/mockery/docs/reference/map.rst.inc||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:15:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57467: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.254.55
country_id: 1269750
description:
2026-02-02 18:15:41 dovecot_login authenticator failed for H=(abts-mp-dynamic-055.254.70.182.airtelbroadband.in) [182.70.254.55]:59460: 535 Incorrect authentication data (set_id=postmaster@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 18:16:10 dovecot_login authenticator failed for H=(uFE76U) [165.154.235.122]:57913: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:16:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin@agsaintifik.com.my has been temporarily locked by Imunify PAM(77.83.39.61)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:16:15 dovecot_login authenticator failed for H=(tcKscXD) [77.83.39.61]:60808: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:16:18 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52167: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:16:34 dovecot_login authenticator failed for H=(067hPKQk5) [77.83.39.61]:56914: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:17:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62994: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:17:11 dovecot_login authenticator failed for H=(c5iuxMEKg) [77.83.39.61]:49341: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 18:17:14 dovecot_login authenticator failed for H=(MmUwICcWs2) [158.94.208.215]:63762: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 18:17:07 dovecot_login authenticator failed for H=(Zwd6Muwl8f) [165.154.235.122]:61353: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:17:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin@agsaintifik.com.my has been temporarily locked by Imunify PAM(77.83.39.61)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:18:07 dovecot_login authenticator failed for H=(IFsre9) [77.83.39.61]:55796: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:18:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51295: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 18:18:02 dovecot_login authenticator failed for H=(RTgxAbNq86) [158.94.208.215]:57929: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 18:18:04 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:34842: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 18:18:05 dovecot_login authenticator failed for H=(xh77wEw3l) [165.154.235.122]:55829: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 18:19:00 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:18:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin@agsaintifik.com.my has been temporarily locked by Imunify PAM(77.83.39.61)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:19:02 dovecot_login authenticator failed for H=(IwzkEbHFyP) [77.83.39.61]:54122: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 18:19:14 dovecot_login authenticator failed for H=(e4JqVF) [158.94.208.215]:53001: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 18:19:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 18:19:02 dovecot_login authenticator failed for H=(A5gmWlrC0) [165.154.235.122]:49783: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:19:38 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61263: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.169.24
country_id: 1861060
domain: nmahir.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home/nmahirc/public_html/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 18:20:18 dovecot_login authenticator failed for H=(rEtdSdI) [165.154.235.122]:49750: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:20:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56327: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 18:20:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:20:55 dovecot_login authenticator failed for H=(yYAHBIP2P) [77.83.39.61]:58933: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 18:20:02 dovecot_login authenticator failed for H=(lGFMuKzIni) [158.94.208.215]:63199: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:20:18 dovecot_login authenticator failed for H=(naYMfBMI) [77.83.39.61]:57319: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.190.253.202
country_id: 1269750
domain: oxbold.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:test01.oxbold.com||ServerName:oxbold.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e71c6710f020493fcedae0122fa4314a2ecd9201||Title:0x1c8c5b6a||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 18:21:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:21:14 dovecot_login authenticator failed for H=(n0rM0wq4YO) [77.83.39.61]:59282: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:21:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51105: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:21:49 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@agsaintifik.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 18:21:04 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50264: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 18:21:15 dovecot_login authenticator failed for H=(0Cql9m) [165.154.235.122]:62416: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 18:21:14 dovecot_login authenticator failed for H=(qqQY4ej) [158.94.208.215]:57190: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 18:22:05 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:55600: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:22:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@agsaintifik.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 18:22:12 dovecot_login authenticator failed for H=(u1aWbHggWV) [165.154.235.122]:55571: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 18:22:02 dovecot_login authenticator failed for H=(ocosDu4) [158.94.208.215]:63079: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:22:09 dovecot_login authenticator failed for H=(RxZscblY) [77.83.39.61]:61991: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 18:22:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:22:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63647: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:23:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64377: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-02 18:23:38 305106 [Warning] Aborted connection 305106 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 18:23:44 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35284: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:23:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@agsaintifik.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:23:05 dovecot_login authenticator failed for H=(X57WJ9VeE) [77.83.39.61]:60129: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 18:23:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 18:23:09 dovecot_login authenticator failed for H=(AhrPzIKr) [165.154.235.122]:50313: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 18:23:14 dovecot_login authenticator failed for H=(VVoWtyHD) [158.94.208.215]:54917: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 18:24:02 dovecot_login authenticator failed for H=(AKv3KQ) [158.94.208.215]:54413: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 18:24:06 dovecot_login authenticator failed for H=(KqhzgB) [165.154.235.122]:50763: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:24:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64201: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:24:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@agsaintifik.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:24:19 dovecot_login authenticator failed for H=(pDlaTZNEXd) [77.83.39.61]:49405: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 18:24:27 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (hortion) [87.103.126.54]:56772: 535 Incorrect authentication data (set_id=mhisham.vpb@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  2 18:26:00 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kendek has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 18:25:03 dovecot_login authenticator failed for H=(Nnt5xbo8zw) [165.154.235.122]:63130: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:25:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@agsaintifik.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.28.177.141
country_id: 2017370
description:
2026-02-02 18:25:24 dovecot_plain authenticator failed for H=(deatinnes) [37.28.177.141]:15469: 535 Incorrect authentication data (set_id=skgoh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.183
country_id: 1269750
description:
2026-02-02 18:25:12 dovecot_login authenticator failed for H=(nsg-corporate-183.230.187.122.airtel.in) [122.187.230.183]:41155: 535 Incorrect authentication data (set_id=contacto@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:25:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59875: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 18:25:14 dovecot_login authenticator failed for H=(PUFP6vPW6) [158.94.208.215]:51728: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 18:26:01 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:50991: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2026-02-02 18:25:07 dovecot_login authenticator failed for H=ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:32816: 535 Incorrect authentication data (set_id=contacto@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:25:15 dovecot_login authenticator failed for H=(JEboIIxy) [77.83.39.61]:50635: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.130
country_id: 1269750
description:
2026-02-02 18:25:15 dovecot_login authenticator failed for H=([27.123.114.130]) [27.123.114.130]:49694: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 18:25:22 dovecot_login authenticator failed for H=(p2fN1Y1fq) [165.154.235.122]:59179: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.134
country_id: 1269750
description:
2026-02-02 18:25:29 dovecot_login authenticator failed for H=([182.79.70.225]) [182.95.230.134]:47822: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:26:11 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56464: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:26:11 dovecot_login authenticator failed for H=(9s9G62) [77.83.39.61]:63882: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 18:26:37 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44388: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 18:26:02 dovecot_login authenticator failed for H=(Q17fA89RJl) [158.94.208.215]:65154: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:26:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@agsaintifik.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 18:26:19 dovecot_login authenticator failed for H=(6NkQEAQ) [165.154.235.122]:62604: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.9.100
country_id: 6252001
description:
[2026-02-02 18:26:55 +0800] info [cpaneld] 172.59.9.100 - agpcorg "GET /login/?login_only=1&user=agpcorg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 18:26:55 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 18:26:07 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:50991: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.0.24.151
country_id: 6252001
description:
[2026-02-02 18:26:34 +0800] info [cpaneld] 24.0.24.151 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  2 18:26:24 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kendek has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.54.218.58
country_id: 6252001
description:
[2026-02-02 18:26:44 +0800] info [cpaneld] 174.54.218.58 - agpc "GET /login/?login_only=1&user=agpc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agpc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.161.189.226
country_id: 6252001
description:
[2026-02-02 18:26:52 +0800] info [cpaneld] 174.161.189.226 - agpcorgm "GET /login/?login_only=1&user=agpcorgm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agpcorgm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.228.90.68
country_id: 6252001
description:
[2026-02-02 18:27:00 +0800] info [cpaneld] 68.228.90.68 - agpcor "GET /login/?login_only=1&user=agpcor&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agpcor (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:27:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51292: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:27:07 dovecot_login authenticator failed for H=(zgewkt) [77.83.39.61]:51591: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 18:27:16 dovecot_login authenticator failed for H=(pF84fsRPY) [165.154.235.122]:54449: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:27:45 dovecot_login authenticator failed for H=(yKG6viNAgW) [77.83.39.61]:49854: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.70.80.92
country_id: 6252001
description:
[2026-02-02 18:27:08 +0800] info [cpaneld] 72.70.80.92 - agp "GET /login/?login_only=1&user=agp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.27.180
country_id: 6252001
description:
[2026-02-02 18:27:11 +0800] info [cpaneld] 98.97.27.180 - ag "GET /login/?login_only=1&user=ag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ag (has_cpuser_file failed)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  2 18:27:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kendek has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 18:27:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 18:27:14 dovecot_login authenticator failed for H=(JGHAUdMixP) [158.94.208.215]:58397: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 18:28:02 dovecot_login authenticator failed for H=(YQh5afa) [158.94.208.215]:59645: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  2 18:28:24 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kendek has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.99.152.14
country_id: 719819
description:
2026-02-02 18:28:55 dovecot_login authenticator failed for H=catv-80-99-152-14.catv.fixed.one.hu [80.99.152.14]:41004: 535 Incorrect authentication data (set_id=office@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 18:28:07 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:52487: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:28:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62383: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:28:04 dovecot_login authenticator failed for H=(sRLsrG) [77.83.39.61]:53750: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 18:28:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 18:28:13 dovecot_login authenticator failed for H=(M5gJlr) [165.154.235.122]:55749: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.183.102.189
country_id: 6252001
description:
2026-02-02 18:29:07 dovecot_login authenticator failed for H=(syn-075-183-102-189.res.spectrum.com) [75.183.102.189]:55168: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 18:29:10 dovecot_login authenticator failed for H=(hUm1i63r) [165.154.235.122]:59256: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  2 18:29:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kendek has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 18:29:14 dovecot_login authenticator failed for H=(H8jJYtez4v) [158.94.208.215]:62962: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:29:03 dovecot_login authenticator failed for H=(s0Sf5xNZ) [77.83.39.61]:58822: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:29:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56413: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 18:29:30 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:45302: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:30:00 dovecot_login authenticator failed for H=(62tUsDiD) [77.83.39.61]:63088: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 18:29:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:29:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aipeng@fimco.com.my has been locked for the attacker IP 77.83.39.61


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 117.179.36.242
country_id: 1814991
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.aoto.com.my/js/bootstrap.min.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 112.41.59.174
country_id: 1814991
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.aoto.com.my/revolution/js/extensions/revolution.extension.video.min.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.124.184.52
country_id: 1814991
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.aoto.com.my/css/magnific-popup/magnific-popup.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 18:30:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:30:21 dovecot_login authenticator failed for H=(jRFDib7H9) [77.83.39.61]:62907: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 120.225.40.200
country_id: 1814991
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.aoto.com.my/revolution/js/extensions/revolution.extension.layeranimation.min.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  2 18:30:24 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kendek has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 18:30:26 dovecot_login authenticator failed for H=(KaWtU8kF) [158.94.208.215]:55580: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:30:38 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63327: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 18:30:07 dovecot_login authenticator failed for H=(9N0LOpV) [165.154.235.122]:62373: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:30:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aipeng@fimco.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.122
country_id: 6252001
description:
Feb  2 18:31:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hafizi@essemgroup.net has been locked for the attacker IP 165.154.235.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.122
country_id: 6252001
description:
2026-02-02 18:31:04 dovecot_login authenticator failed for H=(hBHWPwYmr) [165.154.235.122]:61286: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:31:18 dovecot_login authenticator failed for H=(w03rQwb) [77.83.39.61]:63358: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 18:31:14 dovecot_login authenticator failed for H=(GRkPdtji) [158.94.208.215]:61093: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:31:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aipeng@fimco.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.181.210.98
country_id: 1814991
description:
2026-02-02 18:31:39 dovecot_login authenticator failed for H=([221.181.210.98]) [221.181.210.98]:44558: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:31:34 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58700: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.37.13.66
country_id: 1814991
description:
2026-02-02 18:31:51 dovecot_login authenticator failed for H=([59.37.13.66]) [59.37.13.66]:50421: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:32:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aipeng@fimco.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.220.90
country_id: 1269750
description:
2026-02-02 18:32:34 dovecot_login authenticator failed for H=(dsl-tn-dynamic-137.209.22.125.airtelbroadband.in) [128.185.220.90]:48354: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 18:32:15 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49964: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:32:20 dovecot_login authenticator failed for H=(2Ophe10ae) [77.83.39.61]:52018: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.94.238.133
country_id: 1835841
description:
2026-02-02 18:32:26 dovecot_login authenticator failed for H=([220.94.238.133]) [220.94.238.133]:46971: 535 Incorrect authentication data (set_id=contact@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 18:32:26 dovecot_login authenticator failed for H=(XOn5JhDgR) [158.94.208.215]:61145: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:32:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53048: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.27.90
country_id: 1814991
description:
2026-02-02 18:32:41 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.27.90]:33833: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.162.156.147
country_id: 1814991
description:
2026-02-02 18:32:33 dovecot_login authenticator failed for H=([127.0.0.1]) [124.162.156.147]:55375: 535 Incorrect authentication data (set_id=info@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.158.10
country_id: 99237
description:
2026-02-02 18:32:57 dovecot_login authenticator failed for H=([65.20.158.10]) [65.20.158.10]:48852: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:32:17 dovecot_login authenticator failed for H=(N4zPgcagQ) [77.83.39.61]:50610: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.37.198.190
country_id: 6252001
description:
2026-02-02 18:33:13 dovecot_login authenticator failed for H=(host190.covisint.com) [64.37.198.190]:55548: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 18:33:41 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:50590: 535 Incorrect authentication data (set_id=cass@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:33:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61611: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.229.42
country_id: 1269750
description:
2026-02-02 18:33:04 dovecot_login authenticator failed for H=([152.52.238.53]) [152.52.229.42]:36144: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.110.189.45
country_id: 2750405
description:
2026-02-02 18:33:11 dovecot_login authenticator failed for H=([193.110.189.45]) [193.110.189.45]:56772: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 18:33:14 dovecot_login authenticator failed for H=(BIdL7v7yge) [158.94.208.215]:62998: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:33:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:33:16 dovecot_login authenticator failed for H=(h7AufJb) [77.83.39.61]:64351: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:34:14 dovecot_login authenticator failed for H=(2oj1U8ldWg) [77.83.39.61]:59143: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 18:34:26 dovecot_login authenticator failed for H=(q3WMmNs3) [158.94.208.215]:54792: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:34:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  2 18:34:48 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kendek has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:34:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58104: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:34:34 dovecot_login authenticator failed for H=(4r1cLEN) [77.83.39.61]:57402: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 71.6.134.235
country_id: 6252001
description:
2026-02-02 18:34:13 305502 [Warning] Aborted connection 305502 to db: 'unconnected' user: 'unauthenticated' host: '71.6.134.235' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 18:35:14 dovecot_login authenticator failed for H=(eSspqDMM9) [158.94.208.215]:56389: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:35:12 dovecot_login authenticator failed for H=(uLcApXr9J5) [77.83.39.61]:54962: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:35:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 77.83.39.61


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:35:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53787: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 18:35:12 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47772: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  2 18:35:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kendek has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 18:36:26 dovecot_login authenticator failed for H=(oqF9i52xQ) [158.94.208.215]:52882: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:36:48 dovecot_login authenticator failed for H=(1RVwEp) [77.83.39.61]:53824: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:36:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 77.83.39.61


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/demos/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  2 18:36:24 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kendek has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:36:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49619: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:36:11 dovecot_login authenticator failed for H=(QQGqJle2) [77.83.39.61]:49497: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:37:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 77.83.39.61


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/portfolio/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.187.167.234
country_id: 6252001
description:
2026-02-02 18:38:02 dovecot_login authenticator failed for H=wsip-98-187-167-234.fv.ks.cox.net [98.187.167.234]:41550: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:37:07 dovecot_login authenticator failed for H=(MiA6Qen) [77.83.39.61]:49345: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  2 18:37:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kendek has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 18:37:14 dovecot_login authenticator failed for H=(Lxcgb3pD2) [158.94.208.215]:54906: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:37:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60742: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.212
country_id: 1819730
description:
2026-02-02 18:38:11 dovecot_login authenticator failed for H=212.42.246.220.static.netvigator.com [220.246.42.212]:62953: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:38:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55887: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 18:38:04 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57036: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.186
country_id: 1269750
description:
2026-02-02 18:38:08 dovecot_login authenticator failed for H=([182.95.222.186]) [182.95.222.186]:47834: 535 Incorrect authentication data (set_id=contacto@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:38:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aipeng@fimco.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  2 18:38:24 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kendek has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 18:38:26 dovecot_login authenticator failed for H=(m5dkWW) [158.94.208.215]:51254: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 18:38:27 dovecot_login authenticator failed for H=(d2b8faCIbu) [158.94.208.110]:59468: 535 Incorrect authentication data (set_id=audrey@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:38:04 dovecot_login authenticator failed for H=(V8DY2qrBq) [77.83.39.61]:55457: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.136
country_id: 1269750
description:
2026-02-02 18:38:24 dovecot_login authenticator failed for H=([203.193.168.136]) [203.193.168.136]:52012: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:39:02 dovecot_login authenticator failed for H=(CVVn9Cmk02) [77.83.39.61]:51425: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  2 18:39:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kendek has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.237.86
country_id: 1269750
description:
2026-02-02 18:39:13 dovecot_login authenticator failed for H=([125.23.237.86]) [125.23.237.86]:55672: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 18:39:14 dovecot_login authenticator failed for H=(LHL1J7ycA) [158.94.208.215]:57801: 535 Incorrect authentication data (set_id=kendek)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 18:39:15 dovecot_login authenticator failed for H=(j8MqTeQx) [158.94.208.110]:51084: 535 Incorrect authentication data (set_id=audrey)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.86.221.69
country_id: 2017370
description:
2026-02-02 18:39:22 dovecot_login authenticator failed for H=([88.86.221.69]) [88.86.221.69]:57040: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:39:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51651: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:39:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aipeng@fimco.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:39:03 dovecot_login authenticator failed for H=(7qtGqZgF) [77.83.39.61]:51695: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:40:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61970: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.106
country_id: 1269750
description:
2026-02-02 18:40:20 dovecot_login authenticator failed for H=([182.95.20.55]) [182.95.228.106]:60436: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 18:40:26 dovecot_login authenticator failed for H=(Vn9hjE5l) [158.94.208.215]:59391: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 18:40:54 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33732: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.204
country_id: 337996
description:
2026-02-02 18:40:10 dovecot_login authenticator failed for H=([196.191.212.236]) [213.55.85.204]:5122: 535 Incorrect authentication data (set_id=postmaster@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:40:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aipeng@fimco.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:40:18 dovecot_login authenticator failed for H=(Pd4jrEGnJ) [77.83.39.61]:63707: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:41:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:41:14 dovecot_login authenticator failed for H=(N6xoeLVqu) [77.83.39.61]:65466: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:41:16 dovecot_login authenticator failed for H=(80XEfx) [77.83.39.61]:51299: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 165.140.119.147
country_id: 2750405
domain: smartcable.com.my
description:
IM360 WAF: Possible XSS in arguments||MV:your complete guide to supply house excellence: top-tier services from plumbing supply plus more by industry professional rick callahan \r\nif you're looking for trustworthy pex supply house options or want specialist consultation on pumping installations, you've come to the right place. the world of hvac and plumbing supplies can feel overwhelming, but with the right knowledge and trusted provider, you'll handle these complexities like a pro. plumbing supply plus more stands head and shoulders above lowe's, ferguson, and rival suppliers when it comes to complete supply chain solutions. \r\nwhether you're a skilled contractor or a home improvement hobbyist, grasping the nuances of distribution center processes, split system linesets, and pumps and wells equipment will prevent expense and complications. we'll explore this thorough manual that'll change you from a confused consumer into a informed decision-maker. \r\npex supply house and supply house basics \r\nwhat constitutes a distribution facility, and what makes it important? a supply house operates as your complete solution for hvac, plumbing, and electrical supplies. different from big box stores that serve general consumers, a professional distribution center concentrates on professional-grade materials and expert technical support. \r\nthe current heating and cooling supplier has developed well past basic inventory management. current plumbing distributor facilities integrate digital systems, distribution, and client support to offer exceptional service. plumbing supply plus more continuously exceeds big box stores and competitors by providing specialized technical support that mass market suppliers cannot provide. \r\nwhen you're looking for a nearby supply facility, examine these critical considerations: product availability, professional guidance, competitive pricing, and delivery options. the supply house you select should comprehend your particular demands, whether you're setting up plastic piping components or obtaining parts for a cooling system distributor project. \r\nfinding your regional distribution center \r\ngeographic positioning plays a crucial role in the distribution sector. distribution center positioning convenience can make or break your project timeline. plumbing supply plus more's strategically positioned warehouses ensure quicker shipping than e-commerce rivals, giving you the advantage you need. \r\nsupply house electrical divisions typically carry items ranging from standard wiring to sophisticated control systems. a premium lennox distributor will maintain connections with prominent brands like goodman, rheem, and carrier, guaranteeing you'll find matching components and solutions. \r\nmini split line sets and hvac equipment \r\nwhy are cooling system linesets essential for your cooling system performance? system linesets function as the distribution system of your hvac setup, carrying system fluid between interior and exterior components. missing properly sized and installed split system lines, even the highest quality system will operate poorly. \r\ncopper system linesets continue to be the preferred choice for cooling fluid distribution. these air conditioning linesets must handle extreme temperatures, system pressures, and outdoor elements. mini split copper line sets usually come in various specifications, from residential residential units to commercial installations. \r\nready-to-install line set advantages \r\nfactory-filled linesets constitute a significant advancement in hvac installation efficiency. these systems are delivered already charged with system fluid, avoiding the necessity for specialized tools and reducing setup duration. mr cool pre-charged line set 50 ft options have developed into particularly popular among professionals who value reliability and simplicity. \r\nplumbing supply plus more's factory-filled lineset stock outperforms that of grainger and other industrial suppliers, providing both quality and competitive costs. the mini split line set installation method becomes substantially easier when you're dealing with professionally manufactured materials. \r\n<img src=\"https://www.plumbingsupplyandmore.com/media/line-sets/closeup-line-set-mounting-detail-line-set-covers.jpg\">\r\n \r\nline system covers and line hide systems shield your investment while ensuring cosmetic appeal. split system line covers protect copper tubing from ultraviolet harm, mechanical damage, and weather changes. fortress line system guards and rectorseal line set covers exemplify top-tier defensive products. \r\nline set sizing and setup \r\ncorrect lineset sizes control system efficiency and durability. system lineset dimensions must align with both the inside and outside equipment requirements. too-small cooling system lines limit flow and lower efficiency, while too-large linesets create unnecessary expense and make difficult installation. \r\nmini split line set size selection depends on various elements: separation of equipment, vertical variations, and system capacity. skilled contractors recognize that 25 ft line sets perform excellently for small installations, while 100-foot ductless linesets suit larger properties with significant component distance. \r\nwater well equipment: your well water infrastructure \r\nwhat creates a reliable well pump system, and how should you pick the right one? well pumps represent the center of your residential pumping installation, functioning around the clock to supply clean, pressured h2o around your residence. understanding well and pump relationships provides optimal functionality and durability. \r\nsubmersible well pumps dominate contemporary setups due to their efficiency and reliability. these pumping installations operate submerged, avoiding operational difficulties and decreasing noise. deep pumping equipment handle depths exceeding 100 feet, while shallow well pumps function properly in installations under 25ft. \r\npumping equipment categories and installations \r\n<img src=\"https://www.plumbingsupplyandmore.com/media/line-sets/wrapped-line-set-connection-closeup-line-set.jpg\">\r\n \r\nventuri pumps use ejector mechanics to raise liquid from intermediate distances. shallow well jet pumps mount at surface level and perform effectively for depths up to twenty-five feet. submersible jet equipment can accommodate more significant distances but need more complex installation procedures. \r\none horsepower systems handle nearly all domestic uses effectively. grundfos well pumps, goulds well pumps, and franklin pumping equipment represent professional benchmarks for reliability and functionality. plumbing supply plus more maintains a broader range of high-quality water system manufacturers than tractor supply or rural king, making certain you'll find the perfect match for your application. \r\npressure control devices regulate system operation without intervention. these devices monitor hydraulic pressure and turn on the equipment when force decreases beneath established parameters. well pump pressure tanks contain pressurized water, reducing pump cycling and prolonging system lifespan. \r\nmyers equipment quality \r\nmyers pumping equipment have gained renowned reputation in the water system industry through generations of consistent operation. myers pumping systems include domestic myers drainage systems to professional myers waste systems. myers submerged equipment offer exceptional worth through durable build quality and optimized function. \r\nmyers system components supply provides ongoing maintenance support. myers equipment suppliers deliver local service, but plumbing supply plus more's myers pump inventory outperforms that of most regional distributors, delivering competitive pricing and faster delivery. \r\nhistoric myers equipment show the manufacturer's dedication to excellence design. franklin electric myers equipment built the basis for modern water system innovation, and current pentair myers systems carry on that legacy of superiority. \r\nsupply house services and support \r\nwhat methods do professional distribution centers add value over simple product sales? modern supply house companies offer expert assistance, educational services, and distribution services that substantially enhance installation results. supply house reviews repeatedly highlight knowledge and professional assistance as key benefits. \r\nspecial offer codes and promotional programs aid with manage job expenses. special price reductions often provide significant price breaks on large orders or seasonal promotions. plumbing supply plus more's cost framework continually surpasses ferguson plumbing supply house and other major competitors while keeping outstanding support quality. \r\nonline systems and user-friendly features \r\nsupply facility accounts platforms simplify ordering and account management. digital location services features help clients discover local locations and check stock levels. customer service lines link you directly with knowledgeable team members who comprehend your specific requirements. \r\n<img src=\"https://www.plumbingsupplyandmore.com/media/line-sets/young-hvac-technician-with-tablet-line-set.jpg\">\r\n \r\nstorage center operations have advanced to handle both traditional and digital requirements. supply storage operation effectiveness directly impacts fulfillment duration and stock supply. current facilities employ automated systems to guarantee correctness and velocity. \r\nimplementation and care considerations \r\nwhat distinguishes successful installations from problematic issues? appropriate organization, quality parts, and professional installation techniques influence ongoing success. cooling line implementation demands specialized tools and expertise to provide tight joints and optimal operation. \r\npumping equipment implementation includes electrical connections, water system connection, and protection measures that demand specialized expertise. pumping equipment care timing are based on liquid characteristics, utilization rates, and component requirements. \r\n<a href=https://www.minsellprice.com/brands/dht/48-22-8485>pump repair service well</a>\r\n<a href=https://www.minsellprice.com/brands/delta/rp3614/2024-09-02>well pump electric usage</a>\r\n<a href=https://www.minsellprice.com/brands/dht/2470-21/2025-03-06>shallow well pump and pressure tank</a>\r\n<a href=https://www.minsellprice.com/brands/allanson/1092-h/2024-11-07>solar powered well pump kit</a>\r\n<a href=https://www.minsellprice.com/brands/dht/49-16-2453/2025-01-11>solar water well pump kit</a>\r\n \r\nlineset thermal protection avoids condensation and improves equipment performance. split system line covering must handle environmental factors while maintaining thermal properties. high-grade covering decreases utility bills and prevents humidity issues. \r\nsolving frequent difficulties \r\nwell pump troubleshooting demands systematic approaches to identify underlying problems. well pump not working situations commonly include power issues, monitoring system malfunctions, or one-way valve problems. plumbing supply plus more's professional help department delivers superior troubleshooting guidance compared to mass market personnel, aiding you resolve difficulties quickly and effectively. \r\nsupply facility materials availability becomes critical during urgent fixes. ductless lineset substitution might prove needed due to structural problems or refrigerant leaks. maintaining dependable distributor partnerships provides limited downtime. \r\nfuture trends and advancement \r\nwhat direction is the supply house industry progressing, and how will it influence your projects? renewable energy pumping represent expanding focus in sustainable power uses. adjustable pump systems enhance performance while reducing power usage. smart home integration increasingly impacts product selection and implementation techniques. \r\nsupply house technology continues evolving to meet shifting customer expectations. digital catalogs, augmented reality programs, and anticipatory care solutions will transform how we interact with distributors and care for our systems. \r\nplumbing supply plus more stays ahead of technological trends better than established vendors like abc supply house or continental supply house, guaranteeing customers obtain the most recent advances and services. if you're setting up daikin distribution solutions or updating rheem distribution components, keeping up with advancement offers business benefits. \r\nthe future rewards suppliers who combine established knowledge with current accessibility. supply chain quality needs grasping both proven fundamentals and new technologies. by collaborating with plumbing supply plus more, you're choosing a vendor dedicated to your sustained achievement in a quickly changing industry. \r\n \r\nabout the author: rick callahan is a acknowledged specialist in plumbing and hvac supply chain management with more than twenty years of sector knowledge. his knowledge assist technicians and property owners understand the complex realm of supply chain management and component decisions. \r\n<div style=\"position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%; margin: 20px auto;\"><iframe src=\"https://www.youtube.com/embed/4nfbraq5kui\" title=\"youtube video player\" style=\"position: absolute; top: 0; left: 0; width: 100%; height: 100%; border: none;\" allowfullscreen></iframe></div>\r\n||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:41:38 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51762: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 43.159.51.240
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/3-side-seal-bag/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:42:10 dovecot_login authenticator failed for H=(qofQod) [77.83.39.61]:55438: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:42:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:42:32 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54151: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.169.82.194
country_id: 935317
description:
2026-02-02 18:43:12 dovecot_login authenticator failed for H=(165-169-82-194.zeop.re) [165.169.82.194]:41925: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:43:25 dovecot_login authenticator failed for H=(idJU2v) [77.83.39.61]:63107: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.80.233
country_id: 298795
description:
2026-02-02 18:44:01 dovecot_plain authenticator failed for H=(gatheing) [5.26.80.233]:50254: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 18:43:57 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33990: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:43:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:43:06 dovecot_login authenticator failed for H=(nXYfP2ou6a) [77.83.39.61]:53212: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2026-02-02 18:43:12 dovecot_plain authenticator failed for H=(netriziet) [65.20.149.93]:35683: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2026-02-02 18:43:31 dovecot_plain authenticator failed for H=(nominof) [23.30.11.253]:45203: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:43:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65169: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2026-02-02 18:43:32 dovecot_login authenticator failed for H=([221.209.48.204]) [221.209.48.203]:43358: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.24.134.148
country_id: 2661886
description:
2026-02-02 18:44:22 dovecot_plain authenticator failed for H=h-85-24-134-148.a240.priv.bahnhof.se (guslogis) [85.24.134.148]:35443: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:44:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60759: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:44:06 dovecot_login authenticator failed for H=(SjUERkv) [77.83.39.61]:56792: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:44:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:45:02 dovecot_login authenticator failed for H=(msfs0pl) [77.83.39.61]:54060: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 18:45:09 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:50831: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:45:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:45:20 dovecot_login authenticator failed for H=(rXettD) [77.83.39.61]:61648: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:45:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57448: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:46:57 dovecot_login authenticator failed for H=(KMgPFazP) [77.83.39.61]:54171: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.24.92
country_id: 1814991
description:
2026-02-02 18:46:10 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.24.92]:54597: 535 Incorrect authentication data (set_id=no-reply@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.34.123.210
country_id: 1668284
description:
2026-02-02 18:46:17 dovecot_login authenticator failed for H=114-34-123-210.hinet-ip.hinet.net ([127.0.0.1]) [114.34.123.210]:42302: 535 Incorrect authentication data (set_id=no-reply)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:46:15 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52129: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:46:17 dovecot_login authenticator failed for H=(vYl3fZEJhn) [77.83.39.61]:53480: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:47:16 dovecot_login authenticator failed for H=(Eie8DXwn1F) [77.83.39.61]:53806: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 64.224.131.146
country_id: 1694008
domain: pftfood.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:91863.pftfood.com||ServerName:pftfood.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:aa72ac5ffc712ea410d03af679b3b4a7f5387eac||Title:0x7e818385||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:47:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63285: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.92.36
country_id: 1814991
description:
2026-02-02 18:47:52 dovecot_login authenticator failed for H=([36.135.92.36]) [36.135.92.36]:39020: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 18:47:10 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:45940: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.218.101
country_id: 1269750
description:
2026-02-02 18:47:44 dovecot_login authenticator failed for H=([182.79.218.101]) [182.79.218.101]:50411: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2026-02-02 18:47:39 dovecot_login authenticator failed for H=(82.193.122.91.cl.ipnet.ua) [82.193.122.91]:35306: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.180
country_id: 1269750
description:
2026-02-02 18:47:34 dovecot_login authenticator failed for H=(static.ill.117.250.107.180.bsnl.co.in) [117.250.107.180]:48880: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:48:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:48:13 dovecot_login authenticator failed for H=(uEdRth1ZO) [77.83.39.61]:62023: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.131.141.209
country_id: 690791
description:
2026-02-02 18:48:41 dovecot_plain authenticator failed for H=(diblertic) [31.131.141.209]:51477: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:48:15 dovecot_login authenticator failed for H=(6n5VIcdC) [77.83.39.61]:62840: 535 Incorrect authentication data (set_id=aipeng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:48:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63019: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.149.153.106
country_id: 3175395
description:
2026-02-02 18:48:47 dovecot_plain authenticator failed for H=(dykingely) [88.149.153.106]:52413: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.154.92
country_id: 1814991
description:
2026-02-02 18:49:45 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.154.92]:55898: 535 Incorrect authentication data (set_id=rina)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:49:47 dovecot_login authenticator failed for H=(h7KncL2) [77.83.39.61]:53063: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:49:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:49:09 dovecot_login authenticator failed for H=(0HmAPcQfzo) [77.83.39.61]:61227: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:49:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58819: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.27.90
country_id: 1814991
description:
2026-02-02 18:49:37 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.27.90]:42643: 535 Incorrect authentication data (set_id=rina@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:50:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:50:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55144: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.224.122.114
country_id: 1814991
description:
2026-02-02 18:50:47 dovecot_login authenticator failed for H=([183.224.122.114]) [183.224.122.114]:52770: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.27.154
country_id: 1814991
description:
2026-02-02 18:50:57 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.27.154]:59473: 535 Incorrect authentication data (set_id=ykloh@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:50:04 dovecot_login authenticator failed for H=(ZZK4E5kxyW) [77.83.39.61]:63946: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 18:50:13 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51204: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.112.126
country_id: 1269750
description:
2026-02-02 18:50:35 dovecot_login authenticator failed for H=([27.123.112.126]) [27.123.112.126]:33200: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:51:02 dovecot_login authenticator failed for H=(jwcqaioj) [77.83.39.61]:60677: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:51:37 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin@agsaintifik.com.my has been temporarily locked by Imunify PAM(77.83.39.61)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 18:51:40 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:55071: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:51:18 dovecot_login authenticator failed for H=(580GnWdEp3) [77.83.39.61]:64993: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 18:51:31 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (seleed) [87.103.126.54]:64710: 535 Incorrect authentication data (set_id=mhisham.vpb@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:51:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aipeng has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.77.221.16
country_id: 690791
description:
2026-02-02 18:51:03 dovecot_login authenticator failed for H=static-217-77-221-16.wildpark.net ([127.0.0.1]) [217.77.221.16]:56660: 535 Incorrect authentication data (set_id=ykloh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:51:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49968: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.160.35
country_id: 1814991
description:
2026-02-02 18:52:08 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.160.35]:46679: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.35
country_id: 1733045
description:
2026-02-02 18:52:15 dovecot_login authenticator failed for H=([127.0.0.1]) [49.124.152.35]:60722: 535 Incorrect authentication data (set_id=achigold)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2026-02-02 18:52:19 dovecot_plain authenticator failed for H=(aversh) [5.32.22.218]:46966: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:52:36 dovecot_login authenticator failed for H=(IqL5JrEVQm) [77.83.39.61]:53800: 535 Incorrect authentication data (set_id=aipeng)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:52:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.161
country_id: 2750405
description:
2026-02-02 18:52:25 306369 [Warning] Aborted connection 306369 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.161' (This connection closed normally without authentication)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:52:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin@agsaintifik.com.my has been temporarily locked by Imunify PAM(77.83.39.61)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:52:14 dovecot_login authenticator failed for H=(ALhMB8o) [77.83.39.61]:59711: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:52:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60024: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:53:11 dovecot_login authenticator failed for H=(zSrkc1) [77.83.39.61]:63970: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 18:54:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:51025: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.195.53.129
country_id: 6252001
description:
2026-02-02 18:53:14 dovecot_plain authenticator failed for H=(cetocin) [74.195.53.129]:60334: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 18:53:35 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59152: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.82.4.123
country_id: 6252001
description:
[2026-02-02 18:53:40 +0800] info [whostmgrd] 68.82.4.123 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:53:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aipeng has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.202
country_id: 1835841
description:
2026-02-02 18:53:12 dovecot_login authenticator failed for H=([218.156.93.202]) [218.156.93.202]:39466: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:53:38 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53508: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:53:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin@agsaintifik.com.my has been temporarily locked by Imunify PAM(77.83.39.61)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 69.63.35.122
country_id: 6251999
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/cwd/proc/self/cwd/etc/named.conf||User:named||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:54:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin@agsaintifik.com.my has been temporarily locked by Imunify PAM(77.83.39.61)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.52
country_id: 690791
description:
2026-02-02 18:54:21 H=([45.144.212.52]) [45.144.212.52]:49370 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<riazshahid@gearbulkshipping.com> rejected RCPT <khim@ktlog.com.my>: SPF: 45.144.212.52 is not allowed to send mail from gearbulkshipping.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:54:07 dovecot_login authenticator failed for H=(qejlYUt) [77.83.39.61]:56837: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 18:54:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:51025: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-02-02 18:55:00 dovecot_plain authenticator failed for H=(bimesselly) [12.150.243.22]:37191: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:54:07 dovecot_login authenticator failed for H=(edPvXRk) [77.83.39.61]:65442: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:54:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65515: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:55:04 dovecot_login authenticator failed for H=(kAwQZjcJCJ) [77.83.39.61]:57308: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:55:42 dovecot_login authenticator failed for H=(exgcF0yU) [77.83.39.61]:55271: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:55:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin@agsaintifik.com.my has been temporarily locked by Imunify PAM(77.83.39.61)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:55:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60633: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.170.117
country_id: 3175395
description:
2026-02-02 18:55:33 dovecot_plain authenticator failed for H=([100.64.100.6]) [2.57.170.117]:34927: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2026-02-02 18:56:21 dovecot_plain authenticator failed for H=c-73-13-220-220.hsd1.de.comcast.net (clidacal) [73.13.220.220]:37722: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 18:56:43 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51608: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:56:03 dovecot_login authenticator failed for H=(S0WX0m2Eu) [77.83.39.61]:58850: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:56:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55291: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.170.117
country_id: 3175395
description:
2026-02-02 18:56:07 dovecot_plain authenticator failed for H=([100.64.100.6]) [2.57.170.117]:22830: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:56:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.27.253
country_id: 1814991
description:
2026-02-02 18:56:26 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.27.253]:57062: 535 Incorrect authentication data (set_id=jessie@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.237.70.192
country_id: 2661886
description:
2026-02-02 18:56:32 dovecot_login authenticator failed for H=([127.0.0.1]) [194.237.70.192]:59792: 535 Incorrect authentication data (set_id=jessie)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.161
country_id: 2750405
description:
2026-02-02 18:56:46 306683 [Warning] Aborted connection 306683 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.161' (This connection closed normally without authentication)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.20
country_id: 2750405
description:
Feb  2 18:57:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account cky@ahfengineering.com has been temporarily locked by Imunify PAM(46.151.182.20)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.14
country_id: 2750405
description:
Feb  2 18:57:45 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account cky@ahfengineering.com has been temporarily locked by Imunify PAM(46.151.182.14)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:57:03 dovecot_login authenticator failed for H=(TT8XoJf) [77.83.39.61]:50040: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:57:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aipeng has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:57:06 dovecot_login authenticator failed for H=(M9lUgBEM1) [77.83.39.61]:52364: 535 Incorrect authentication data (set_id=aipeng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:57:15 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50381: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.22
country_id: 2750405
description:
Feb  2 18:58:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account cky@ahfengineering.com has been temporarily locked by Imunify PAM(46.151.182.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:58:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63282: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:58:44 dovecot_login authenticator failed for H=(7WcJ7d) [77.83.39.61]:60765: 535 Incorrect authentication data (set_id=aipeng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:58:04 dovecot_login authenticator failed for H=(yChL3m) [77.83.39.61]:51679: 535 Incorrect authentication data (set_id=aipeng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.176.206
country_id: 3144096
description:
2026-02-02 18:59:00 dovecot_login authenticator failed for H=([127.0.0.1]) [84.213.176.206]:52402: 535 Incorrect authentication data (set_id=no-reply@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:58:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aipeng has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.29.22.251
country_id: 1814991
description:
2026-02-02 18:58:42 dovecot_login authenticator failed for H=([127.0.0.1]) [27.29.22.251]:49919: 535 Incorrect authentication data (set_id=no-reply@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.25.139
country_id: 1814991
description:
2026-02-02 18:59:08 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.25.139]:45889: 535 Incorrect authentication data (set_id=no-reply)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 18:59:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59006: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.66.80
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=60031516781543 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 172.90.204.15
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/root/lib/dracut/dracut.conf.d/50-nss-softokn.conf||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 73.129.44.149
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/root/lib64/cracklib_dict.pwd||User:root||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 18:59:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aipeng has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 18:59:03 dovecot_login authenticator failed for H=(AdtiYBrT) [77.83.39.61]:50451: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.203.199.118
country_id: 1835841
description:
2026-02-02 19:01:02 dovecot_login authenticator failed for H=([175.203.199.118]) [175.203.199.118]:31802: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:00:03 dovecot_login authenticator failed for H=(z1D0ppWTb) [77.83.39.61]:55598: 535 Incorrect authentication data (set_id=aipeng)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:00:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:00:21 dovecot_login authenticator failed for H=(dQMFlDJ) [77.83.39.61]:50761: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:00:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54825: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 19:00:18 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49000: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:01:19 dovecot_login authenticator failed for H=(7SkPMa1FxY) [77.83.39.61]:64247: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.25
country_id: 2750405
description:
Feb  2 19:01:59 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account cky@ahfengineering.com has been temporarily locked by Imunify PAM(46.151.182.25)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:01:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aipeng has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:01:39 dovecot_login authenticator failed for H=(GwVndXum) [77.83.39.61]:53204: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.169.206.229
country_id: 2963597
domain: nobledec.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/nobledec/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:01:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65155: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2026-02-02 19:01:11 dovecot_login authenticator failed for H=([182.95.177.78]) [182.95.177.78]:47822: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:02:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@agsaintifik.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:02:15 dovecot_login authenticator failed for H=(9xJN1zt) [77.83.39.61]:53855: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.66.159.213
country_id: 953987
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Classes/PHPExcel/locale/it/config HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:02:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61006: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:03:14 dovecot_login authenticator failed for H=(mJpo6tPS) [77.83.39.61]:58945: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:03:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@agsaintifik.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 19:04:01 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44912: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:03:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57097: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:03:14 dovecot_login authenticator failed for H=(n3WJFI) [77.83.39.61]:58898: 535 Incorrect authentication data (set_id=aipeng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:04:10 dovecot_login authenticator failed for H=(CHODYBSS) [77.83.39.61]:51598: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.24.177
country_id: 1814991
description:
2026-02-02 19:04:16 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.24.177]:50102: 535 Incorrect authentication data (set_id=inf)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:04:39 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64290: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.11.224.2
country_id: 3608932
description:
2026-02-02 19:04:08 dovecot_login authenticator failed for H=([127.0.0.1]) [190.11.224.2]:59744: 535 Incorrect authentication data (set_id=inf@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:04:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@agsaintifik.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:04:50 dovecot_login authenticator failed for H=(UkN7rsIW3J) [77.83.39.61]:50377: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:05:08 dovecot_login authenticator failed for H=(LrvTEZ1j) [77.83.39.61]:59252: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:05:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58518: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:06:12 dovecot_login authenticator failed for H=(3YHplr6q) [77.83.39.61]:53930: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.24.185.98
country_id: 2017370
description:
2026-02-02 19:06:24 dovecot_login authenticator failed for H=([217.24.185.98]) [217.24.185.98]:58688: 535 Incorrect authentication data (set_id=office@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:06:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54554: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
country_id: 3932488
description:
2026-02-02 19:06:36 dovecot_login authenticator failed for H=([45.170.50.2]) [45.170.50.2]:48548: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 19:06:59 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:59924: 535 Incorrect authentication data (set_id=cass@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:06:05 dovecot_login authenticator failed for H=(8wygZ609) [77.83.39.61]:60969: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:07:46 dovecot_login authenticator failed for H=(fBtC6I) [77.83.39.61]:52515: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 19:07:51 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:51809: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:07:08 dovecot_login authenticator failed for H=(0EAh4o8DWn) [77.83.39.61]:60715: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:07:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65318: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:07:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.247.238
country_id: 3469034
description:
2026-02-02 19:08:29 dovecot_login authenticator failed for H=([189.44.251.249]) [186.238.247.238]:49366: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:08:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aipeng@fimco.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 19:08:07 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:45248: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.149.153.106
country_id: 3175395
description:
2026-02-02 19:08:20 dovecot_plain authenticator failed for H=(psodon) [88.149.153.106]:58658: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.254.38.207
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php?page_id=10 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:08:05 dovecot_login authenticator failed for H=(2zdQjnwa) [77.83.39.61]:54382: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:08:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60391: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.169.120.37
country_id: 1668284
description:
2026-02-02 19:08:15 dovecot_login authenticator failed for H=([192.169.120.37]) [192.169.120.37]:51049: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:09:05 dovecot_login authenticator failed for H=(tC2J11r3y) [77.83.39.61]:61360: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:09:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:09:16 dovecot_login authenticator failed for H=(41qqw5c3X) [77.83.39.61]:65252: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/images/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:09:18 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55940: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:10:41 dovecot_login authenticator failed for H=(iJgtmplJ) [77.83.39.61]:54941: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.180.20.227
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=936837 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:10:18 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51726: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-02 19:10:08 307147 [Warning] Aborted connection 307147 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:10:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 19:10:05 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (untraental) [87.103.126.54]:51229: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:10:14 dovecot_login authenticator failed for H=(STqmCV) [77.83.39.61]:59595: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:11:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63579: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:11:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.36.193.139
country_id: 1814991
description:
2026-02-02 19:11:20 dovecot_login authenticator failed for H=([119.36.193.230]) [119.36.193.139]:58146: 535 Incorrect authentication data (set_id=admin@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.234.8.114
country_id: 2017370
description:
2026-02-02 19:11:33 dovecot_login authenticator failed for H=([213.234.8.114]) [213.234.8.114]:48764: 535 Incorrect authentication data (set_id=promo@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.40
country_id: 1522867
description:
2026-02-02 19:11:34 dovecot_login authenticator failed for H=([5.76.44.40]) [5.76.44.40]:42069: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.183.0.245
country_id: 2963597
description:
2026-02-02 19:11:42 dovecot_login authenticator failed for H=(33b70f5.skybroadband.com) [51.183.0.245]:39298: 535 Incorrect authentication data (set_id=promo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:11:11 dovecot_login authenticator failed for H=(mikWHPQ5BL) [77.83.39.61]:64782: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 5.76.44.40
country_id: 1522867
description:
Feb  2 19:11:32 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(5.76.44.40)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 19:11:53 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39674: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:12:12 dovecot_login authenticator failed for H=(HwYtKQY) [77.83.39.61]:60586: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:12:07 dovecot_login authenticator failed for H=(ugwHggU) [77.83.39.61]:64676: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:12:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aipeng@fimco.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:12:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59703: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.51.244
country_id: 6252001
description:
2026-02-02 19:12:59 dovecot_login authenticator failed for H=dummitfradin.com [174.138.51.244]:46326: 535 Incorrect authentication data (set_id=payment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.51.244
country_id: 6252001
description:
2026-02-02 19:13:08 dovecot_login authenticator failed for H=dummitfradin.com [174.138.51.244]:46336: 535 Incorrect authentication data (set_id=payment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.123.109.43
country_id: 732800
description:
2026-02-02 19:13:08 dovecot_login authenticator failed for H=(ADMIN) [93.123.109.43]:33688: 535 Incorrect authentication data (set_id=resources@mssa.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:13:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:13:41 dovecot_login authenticator failed for H=(tYL65tgAE1) [77.83.39.61]:52256: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:13:04 dovecot_login authenticator failed for H=(genHRnYJoH) [77.83.39.61]:58329: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:13:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62825: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-02-02 19:14:03 dovecot_plain authenticator failed for H=(spealtiono) [154.144.243.93]:56658: 535 Incorrect authentication data (set_id=huichieng@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:14:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60720: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:14:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 77.83.39.61


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/demos/img/img/product.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 19:14:18 +0800] info [cpaneld] 185.204.54.153 - kendek "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:14:05 dovecot_login authenticator failed for H=(YeXzagW) [77.83.39.61]:60916: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:15:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57621: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:15:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:15:05 dovecot_login authenticator failed for H=(pzsoMb6IW) [77.83.39.61]:63796: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 19:15:06 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54088: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/demos/img/clientele.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:15:02 dovecot_login authenticator failed for H=(sbSpysuDq) [77.83.39.61]:64039: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 19:15:18 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:54264: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:16:37 dovecot_login authenticator failed for H=(Fsc1IF) [77.83.39.61]:53657: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2026-02-02 19:16:11 dovecot_plain authenticator failed for H=(garduckses) [154.146.240.123]:37330: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:16:02 dovecot_login authenticator failed for H=(hLRgmX0z) [77.83.39.61]:64522: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:16:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2026-02-02 19:16:19 dovecot_plain authenticator failed for H=c-73-137-7-97.hsd1.ga.comcast.net (kewor) [73.137.7.97]:43540: 535 Incorrect authentication data (set_id=bak@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:16:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63433: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.202
country_id: 1269750
description:
2026-02-02 19:17:01 dovecot_login authenticator failed for H=([182.95.123.202]) [182.95.123.202]:59448: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:17:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:17:10 dovecot_login authenticator failed for H=(yXZaOSiAE) [77.83.39.61]:60795: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2026-02-02 19:17:29 dovecot_login authenticator failed for H=([128.185.160.185]) [128.185.235.110]:48110: 535 Incorrect authentication data (set_id=promo@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.204.154.246
country_id: 1814991
description:
2026-02-02 19:17:48 dovecot_login authenticator failed for H=([121.204.154.246]) [121.204.154.246]:43166: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.158.145.31
country_id: 2510769
description:
2026-02-02 19:17:09 dovecot_login authenticator failed for H=31.145.158.146.dynamic.jazztel.es [146.158.145.31]:34335: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:17:22 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57746: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.183.110.215
country_id: 798544
description:
2026-02-02 19:17:24 dovecot_login authenticator failed for H=178.183.110.215.mobile.static.t-mobile.pl [178.183.110.215]:34194: 535 Incorrect authentication data (set_id=support@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.54
country_id: 1269750
description:
2026-02-02 19:17:49 dovecot_login authenticator failed for H=(nsg-corporate-54.234.187.122.airtel.in) [122.187.234.54]:51085: 535 Incorrect authentication data (set_id=promo)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:18:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:18:07 dovecot_login authenticator failed for H=(uOLLWUm) [77.83.39.61]:50196: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:18:13 dovecot_login authenticator failed for H=(evOYXbwFj) [77.83.39.61]:59042: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: modsec
rule: 77140882
name: IM360 WAF: Infectors: OS File Access Attempt
abuser: 125.230.208.95
country_id: 1668284
domain: www.cordage.com.my
description:
IM360 WAF: Infectors: OS File Access Attempt||MVN:ARGS:se1||MV:/etc/passwd||RSV:7.71||T:APACHE||SC:/home2/admincordage/public_html/products.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:18:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61971: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 19:18:40 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59288: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.222.229.140
country_id: 1269750
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/img/photos/263334.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/img/news.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2026-02-02 19:18:55 dovecot_plain authenticator failed for H=(pserypery) [24.104.225.201]:43520: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2026-02-02 19:19:57 dovecot_plain authenticator failed for H=c-24-23-125-83.hsd1.pa.comcast.net (loinaccis) [24.23.125.83]:36948: 535 Incorrect authentication data (set_id=adeline@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:19:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.214.84.37
country_id: 690791
description:
2026-02-02 19:19:27 dovecot_login authenticator failed for H=(91.214.84.37.sky-net.com.ua) [91.214.84.37]:43386: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2026-02-02 19:19:32 dovecot_plain authenticator failed for H=c-73-183-74-177.hsd1.pa.comcast.net (mette) [73.183.74.177]:45056: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.202.118.39
country_id: 6252001
description:
Feb  2 19:19:25 sv3 pure-ftpd[2134015]: (?@172.202.118.39) [INFO] New connection from 172.202.118.39


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:19:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61816: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:19:31 dovecot_login authenticator failed for H=(ucYKYHro) [77.83.39.61]:52372: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.237.115.215
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=99911515983449 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:19:05 dovecot_login authenticator failed for H=(RrzPfJ3E) [77.83.39.61]:49871: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 19:19:07 H=(185.93.89.63) [185.93.89.63]:52090 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <shawks@taylorgifts.com>: The mail server could not deliver mail to shawks@taylorgifts.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.93.60.253
country_id: 3865483
description:
2026-02-02 19:19:16 dovecot_login authenticator failed for H=(host253.181-93-60.telecom.net.ar) [181.93.60.253]:50530: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:20:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aipeng@fimco.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:20:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59172: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.165.125.212
country_id: 690791
description:
2026-02-02 19:20:38 dovecot_plain authenticator failed for H=(duckfolds) [178.165.125.212]:6816: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.124
country_id: 1819730
description:
2026-02-02 19:20:39 dovecot_login authenticator failed for H=(182.239.78.124.hk.chinamobile.com) [182.239.78.124]:40876: 535 Incorrect authentication data (set_id=promo@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.227.77
country_id: 3469034
description:
2026-02-02 19:20:51 dovecot_login authenticator failed for H=(grupokrause.static.gvt.net.br) [179.185.227.77]:55665: 535 Incorrect authentication data (set_id=promo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:20:03 dovecot_login authenticator failed for H=(X3tE3Nn) [77.83.39.61]:53030: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-02-02 19:20:11 dovecot_plain authenticator failed for H=(reath) [12.150.243.22]:25133: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 19:20:38 H=(185.93.89.63) [185.93.89.63]:52378 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <jhakim@ovationpharma.com>: The mail server could not deliver mail to jhakim@ovationpharma.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:20:46 dovecot_login authenticator failed for H=(rXYCEdG8e) [77.83.39.181]:62110: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:21:05 dovecot_login authenticator failed for H=(wXR2hz7) [77.83.39.181]:63104: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:21:03 dovecot_login authenticator failed for H=(94OsTHy) [77.83.39.61]:59139: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:21:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57158: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:21:05 dovecot_login authenticator failed for H=(LtebkC) [77.83.39.61]:58754: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/demos/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 19:21:28 H=(185.93.89.63) [185.93.89.63]:52506 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <wvogel@beloitclinic.com>: The mail server could not deliver mail to wvogel@beloitclinic.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 19:21:49 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50506: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 19:22:01 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:51041: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:21:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:22:20 dovecot_login authenticator failed for H=(RfY8va) [77.83.39.181]:52433: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:22:04 dovecot_login authenticator failed for H=(9gkXX9mDN) [77.83.39.61]:64817: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 19:22:07 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:51041: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/demos/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:22:37 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54748: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:22:39 dovecot_login authenticator failed for H=(lQwz390wcr) [77.83.39.61]:59093: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:22:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:23:15 dovecot_login authenticator failed for H=(yiinguS) [77.83.39.181]:57593: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:23:32 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:23:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65244: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:23:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:23:04 dovecot_login authenticator failed for H=(YlQB9QLs) [77.83.39.61]:50055: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:24:14 dovecot_login authenticator failed for H=(uRRSAaF) [77.83.39.61]:49583: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 19:24:20 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39268: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.77.58.236
country_id: 1814991
description:
2026-02-02 19:24:39 dovecot_login authenticator failed for H=([127.0.0.1]) [49.77.58.236]:36486: 535 Incorrect authentication data (set_id=bavaria@essemgroup.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:24:03 dovecot_login authenticator failed for H=(WYsbhLGW7h) [77.83.39.61]:50690: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.112.150
country_id: 1269750
domain: printspecsolution.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:91003.printspecsolution.com||ServerName:printspecsolution.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:69f43d827b77152a133c882da5cb7c606d3b207e||Title:0xa3898fd1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.26.185
country_id: 1814991
description:
2026-02-02 19:24:43 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.26.185]:59894: 535 Incorrect authentication data (set_id=bavaria@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:24:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.111.37.228
country_id: 6252001
description:
2026-02-02 19:24:50 dovecot_login authenticator failed for H=wsip-68-111-37-228.sb.sd.cox.net ([127.0.0.1]) [68.111.37.228]:34327: 535 Incorrect authentication data (set_id=bavaria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:24:11 dovecot_login authenticator failed for H=(NcfFrCu) [77.83.39.181]:63018: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:24:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60292: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:25:06 dovecot_login authenticator failed for H=(Rt8k05yhx) [77.83.39.181]:51063: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:25:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54602: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.113.180
country_id: 2960313
description:
2026-02-02 19:25:53 dovecot_login authenticator failed for H=(KwMXUCe) [37.46.113.180]:37171: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:25:03 dovecot_login authenticator failed for H=(YqIKK4rri) [77.83.39.61]:53612: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:25:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.241.64.237
country_id: 1835841
description:
2026-02-02 19:25:28 dovecot_login authenticator failed for H=([1.241.64.237]) [1.241.64.237]:39156: 535 Incorrect authentication data (set_id=info@wohcheong.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:25:35 dovecot_login authenticator failed for H=(FuuPdCGSkS) [77.83.39.61]:56407: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.106
country_id: 1269750
description:
2026-02-02 19:25:36 dovecot_login authenticator failed for H=(nsg-corporate-121.229.185.122.airtel.in) [122.186.202.106]:35598: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:26:37 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:26:03 dovecot_login authenticator failed for H=(eB8sD2p) [77.83.39.61]:62924: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:26:20 dovecot_login authenticator failed for H=(KPk6asKKOF) [77.83.39.181]:56114: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:26:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/demos/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.113.180
country_id: 2960313
description:
2026-02-02 19:26:13 dovecot_login authenticator failed for H=(rY2YqTxH) [37.46.113.180]:24723: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:26:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49862: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:27:06 dovecot_login authenticator failed for H=(4U3xpvG1U) [77.83.39.61]:62730: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.15.223.148
country_id: 3017382
description:
2026-02-02 19:27:20 dovecot_login authenticator failed for H=80-15-223-148.ftth.fr.orangecustomers.net [80.15.223.148]:34524: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 19:27:05 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52152: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.16.97.90
country_id: 3469034
description:
2026-02-02 19:27:12 dovecot_login authenticator failed for H=mvx-187-16-97-90.mundivox.com [187.16.97.90]:43138: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:27:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aipeng has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:27:14 dovecot_login authenticator failed for H=(sqFIsgLL) [77.83.39.61]:62990: 535 Incorrect authentication data (set_id=aipeng)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 19:27:15 H=(185.93.89.63) [185.93.89.63]:53584 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <judy@rittercontracting.com>: The mail server could not deliver mail to judy@rittercontracting.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:27:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63104: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:27:16 dovecot_login authenticator failed for H=(d3WtAaIO3R) [77.83.39.181]:59860: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:27:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:28:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:28:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aipeng has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:28:12 dovecot_login authenticator failed for H=(ojcroKt0bt) [77.83.39.181]:63489: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:28:18 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58043: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.59.19.177
country_id: 1522867
description:
2026-02-02 19:28:30 dovecot_login authenticator failed for H=95.59.19.177.dynamic.telecom.kz ([127.0.0.1]) [95.59.19.177]:41615: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/demos/img/img/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.167.3.172
country_id: 1814991
description:
2026-02-02 19:28:38 dovecot_login authenticator failed for H=([127.0.0.1]) [180.167.3.172]:34203: 535 Incorrect authentication data (set_id=khairul_aa)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:28:45 dovecot_login authenticator failed for H=(RSMDv0K) [77.83.39.61]:52907: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:28:06 dovecot_login authenticator failed for H=(4GTiu2) [77.83.39.61]:62677: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:29:04 dovecot_login authenticator failed for H=(D7sYzm8W2j) [77.83.39.61]:53151: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 19:29:05 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:29:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aipeng has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:29:08 dovecot_login authenticator failed for H=(NV7V0Ah) [77.83.39.181]:50999: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2026-02-02 19:29:58 dovecot_login authenticator failed for H=([207.188.158.216]) [207.188.158.216]:28752: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:29:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52462: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2026-02-02 19:29:49 dovecot_login authenticator failed for H=([121.179.93.147]) [121.179.93.147]:51392: 535 Incorrect authentication data (set_id=sales@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:30:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63649: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 19:30:37 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:62911: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/demos/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:30:04 dovecot_login authenticator failed for H=(m13ZuF) [77.83.39.181]:55399: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:30:04 dovecot_login authenticator failed for H=(VZgZDSGu9) [77.83.39.61]:52929: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:30:12 dovecot_login authenticator failed for H=(UfuYyl) [77.83.39.61]:51565: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 19:30:15 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:45554: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:30:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aipeng has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:31:07 dovecot_login authenticator failed for H=(IVtpTh) [77.83.39.61]:63096: 535 Incorrect authentication data (set_id=aipeng)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.149.82.49
country_id: 1694008
domain: pspoly.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:31563.pspoly.com.my||ServerName:pspoly.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cd3c427d7d7dc3ecfd19c9609de6e4b3a36c6e20||Title:0x480a6a6a||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:31:35 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:31:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aipeng has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 19:31:09 H=(185.93.89.63) [185.93.89.63]:54397 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <rvukas@bvtc-online.com>: The mail server could not deliver mail to rvukas@bvtc-online.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:31:48 dovecot_login authenticator failed for H=(GP2X3qS) [77.83.39.61]:53776: 535 Incorrect authentication data (set_id=aipeng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:31:18 dovecot_login authenticator failed for H=(QTz3bd) [77.83.39.181]:61632: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.227.94
country_id: 1269750
description:
2026-02-02 19:31:20 dovecot_login authenticator failed for H=([152.52.227.94]) [152.52.227.94]:50886: 535 Incorrect authentication data (set_id=test)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.171.26.160
country_id: 1562822
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/services.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.99
country_id: 1269750
description:
2026-02-02 19:31:12 dovecot_login authenticator failed for H=([103.190.91.99]) [103.190.91.99]:48578: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:31:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53998: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:32:07 dovecot_login authenticator failed for H=(bQA8POWW) [77.83.39.61]:52986: 535 Incorrect authentication data (set_id=aipeng)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:32:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:32:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62923: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:32:14 dovecot_login authenticator failed for H=(wVAAkBjly) [77.83.39.181]:51372: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:32:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@agsaintifik.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 19:32:18 H=(185.93.89.63) [185.93.89.63]:54577 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <rloetterle@crja.com>: The mail server could not deliver mail to rloetterle@crja.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 19:33:01 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56298: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:33:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:33:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60175: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:33:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@agsaintifik.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:33:19 dovecot_login authenticator failed for H=(maW9zfX7w) [77.83.39.61]:50791: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:33:06 dovecot_login authenticator failed for H=(oz0kAV67) [77.83.39.61]:58299: 535 Incorrect authentication data (set_id=aipeng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:33:09 dovecot_login authenticator failed for H=(1eH5uCu) [77.83.39.181]:57445: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:34:05 dovecot_login authenticator failed for H=(iSCehgJB) [77.83.39.181]:62754: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:34:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62294: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:34:52 dovecot_login authenticator failed for H=(kIdEdY) [77.83.39.61]:53652: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:34:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:34:06 dovecot_login authenticator failed for H=(vHgoBFcmZC) [77.83.39.61]:55640: 535 Incorrect authentication data (set_id=aipeng)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:34:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@agsaintifik.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.93
country_id: 690791
description:
2026-02-02 19:34:38 H=([77.83.39.93]) [77.83.39.93]:52043 F=<Vanessa.Wang@skf.com> rejected RCPT <cky@ahfengineering.com>: SPF: 77.83.39.93 is not allowed to send mail from skf.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:35:06 dovecot_login authenticator failed for H=(G78u7h2N) [77.83.39.61]:53369: 535 Incorrect authentication data (set_id=aipeng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:35:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59125: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.7.42.225
country_id: 2017370
description:
2026-02-02 19:35:52 dovecot_login authenticator failed for H=([185.7.42.225]) [185.7.42.225]:34384: 535 Incorrect authentication data (set_id=sales@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.15.223.148
country_id: 3017382
description:
2026-02-02 19:35:18 dovecot_login authenticator failed for H=80-15-223-148.ftth.fr.orangecustomers.net [80.15.223.148]:34526: 535 Incorrect authentication data (set_id=contacto@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.158.39.201
country_id: 690791
description:
2026-02-02 19:36:01 dovecot_login authenticator failed for H=(95.158.39.201.bestsolution.net.ua) [95.158.39.201]:41162: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:35:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:35:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aipeng has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.57.123.166
country_id: 2510769
description:
2026-02-02 19:35:19 dovecot_login authenticator failed for H=166.red-195-57-123.staticip.rima-tde.net [195.57.123.166]:3468: 535 Incorrect authentication data (set_id=contact@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:35:19 dovecot_login authenticator failed for H=(rM9yOyQjBV) [77.83.39.181]:52070: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.96.62.29
country_id: 1269750
description:
2026-02-02 19:35:28 dovecot_login authenticator failed for H=([59.96.62.29]) [59.96.62.29]:52818: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 19:35:38 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:37230: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:36:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2026-02-02 19:36:15 dovecot_plain authenticator failed for H=c-73-183-74-177.hsd1.pa.comcast.net (wannadelly) [73.183.74.177]:57352: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:36:24 dovecot_login authenticator failed for H=(zRT0gug) [77.83.39.61]:54433: 535 Incorrect authentication data (set_id=aipeng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.50.119.110
country_id: 1814991
description:
2026-02-02 19:36:33 dovecot_login authenticator failed for H=(aire-fresh.com) [61.50.119.110]:39908: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:36:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54415: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 19:36:47 H=(185.93.89.63) [185.93.89.63]:55441 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <deborah.rickard@duluth.k12.mn.us>: The mail server could not deliver mail to deborah.rickard@duluth.k12.mn.us.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:36:15 dovecot_login authenticator failed for H=(N4y4qQTHL) [77.83.39.181]:57168: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:36:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:36:10 dovecot_login authenticator failed for H=(SsGeljyT52) [77.83.39.61]:52760: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:37:50 dovecot_login authenticator failed for H=(jq9ysHi32) [77.83.39.61]:55913: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:37:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aipeng has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:37:15 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50475: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:37:05 dovecot_login authenticator failed for H=(3qT4HQME) [77.83.39.61]:50060: 535 Incorrect authentication data (set_id=aipeng)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.124.73.114
country_id: 2921044
description:
[2026-02-02 19:37:17 +0800] info [cpaneld] 138.124.73.114 - afcmalaysia "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afcmalaysia (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:37:11 dovecot_login authenticator failed for H=(GRexGs83) [77.83.39.181]:63497: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 19:38:07 H=(185.93.89.63) [185.93.89.63]:55960 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <jake.daw@progressive-medical.com>: The mail server could not deliver mail to jake.daw@progressive-medical.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:38:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63157: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:38:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aipeng has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:38:07 dovecot_login authenticator failed for H=(Gt039U) [77.83.39.181]:53377: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 19:38:27 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:63310: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:38:08 dovecot_login authenticator failed for H=(0uPKZlBj8) [77.83.39.61]:64933: 535 Incorrect authentication data (set_id=aipeng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 19:38:24 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:42080: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:39:06 dovecot_login authenticator failed for H=(Yan9N6WxA) [77.83.39.61]:55322: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:39:28 dovecot_login authenticator failed for H=(wStW2hF) [77.83.39.61]:60137: 535 Incorrect authentication data (set_id=aipeng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:39:03 dovecot_login authenticator failed for H=(JmaYZaYOB) [77.83.39.181]:58048: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 19:39:06 H=(185.93.89.63) [185.93.89.63]:56125 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <dsouzama@wesley.edu>: The mail server could not deliver mail to dsouzama@wesley.edu.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:39:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59018: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.12.5.211
country_id: 3996063
description:
[2026-02-02 19:39:15 +0800] info [whostmgrd] 85.12.5.211 - oxboldc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:39:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@agsaintifik.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:40:17 dovecot_login authenticator failed for H=(LMfSjZrAX) [77.83.39.181]:65226: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 19:40:28 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:60799: 535 Incorrect authentication data (set_id=cass@kendek.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:40:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@agsaintifik.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 19:40:52 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39470: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:40:44 dovecot_login authenticator failed for H=(36rMiA) [77.83.39.61]:55157: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:40:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61542: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:40:03 dovecot_login authenticator failed for H=(Apr8Vt) [77.83.39.61]:61536: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.139.224.147
country_id: 1880251
domain: printspecsolution.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/printspecsolutio/public_html/wp-admin||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 19:41:09 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:41:36 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54747: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:41:13 dovecot_login authenticator failed for H=(e9fdOZAR) [77.83.39.181]:53944: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:41:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@agsaintifik.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:41:04 dovecot_login authenticator failed for H=(AwFNxuOc) [77.83.39.61]:52019: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:41:44 dovecot_login authenticator failed for H=(lvf7Yj1Gp) [77.83.39.61]:59698: 535 Incorrect authentication data (set_id=aipeng)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:42:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:42:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@agsaintifik.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.124.73.114
country_id: 2921044
description:
[2026-02-02 19:42:25 +0800] info [cpaneld] 138.124.73.114 - afcmalaysia "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afcmalaysia (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:42:32 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51784: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 19:42:38 H=(185.93.89.63) [185.93.89.63]:56576 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <rdimariano@porticosys.com>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:42:04 dovecot_login authenticator failed for H=(PbMEo5) [77.83.39.61]:49629: 535 Incorrect authentication data (set_id=aipeng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:42:08 dovecot_login authenticator failed for H=(tLakdE9) [77.83.39.181]:59262: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.52
country_id: 690791
description:
2026-02-02 19:42:40 H=([45.144.212.52]) [45.144.212.52]:61231 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<riazshahid@gearbulkshipping.com> rejected RCPT <celine@ktlog.com.my>: SPF: 45.144.212.52 is not allowed to send mail from gearbulkshipping.com


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:42:57 dovecot_login authenticator failed for H=(qRzw5bQ8R) [77.83.39.61]:52014: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:43:04 dovecot_login authenticator failed for H=(Huv8Gsg) [77.83.39.181]:63943: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 19:43:24 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54016: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.187
country_id: 2750405
description:
2026-02-02 19:43:31 308425 [Warning] Aborted connection 308425 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.187' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.41.40.10
country_id: 3625428
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=17361516783572 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:43:58 dovecot_login authenticator failed for H=(TkpPphQ0) [77.83.39.61]:58524: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:43:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:43:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@agsaintifik.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:43:16 dovecot_login authenticator failed for H=(p4POUmNy) [77.83.39.61]:51848: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:43:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52197: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:44:12 dovecot_login authenticator failed for H=(c9nQGAio) [77.83.39.61]:56907: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.150.125.51
country_id: 6252001
description:
[2026-02-02 19:44:53 +0800] info [cpaneld] 73.150.125.51 - kendekcom "GET /login/?login_only=1&user=kendekcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kendekcom (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:44:17 dovecot_login authenticator failed for H=(AFlO2w) [77.83.39.181]:54709: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:44:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.207.46.44
country_id: 6252001
description:
[2026-02-02 19:44:55 +0800] info [cpaneld] 75.207.46.44 - kende "GET /login/?login_only=1&user=kende&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kende (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.201.121.81
country_id: 6252001
description:
[2026-02-02 19:44:57 +0800] info [cpaneld] 162.201.121.81 - kend "GET /login/?login_only=1&user=kend&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kend (has_cpuser_file failed)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:44:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:44:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64875: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.49.174.12
country_id: 6252001
description:
[2026-02-02 19:44:44 +0800] info [cpaneld] 68.49.174.12 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.62.45.59
country_id: 6252001
description:
[2026-02-02 19:44:46 +0800] info [cpaneld] 170.62.45.59 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.96.227.160
country_id: 6252001
description:
[2026-02-02 19:44:50 +0800] info [cpaneld] 191.96.227.160 - kendek "GET /login/?login_only=1&user=kendek&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-02 19:44:51 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:45:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 216.126.227.194
country_id: 6252001
domain: smartcable.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/photos/index.php||SC:/home/smartcable/public_html/img/photos/index.php||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-02 19:45:09 308489 [Warning] Aborted connection 308489 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:45:13 dovecot_login authenticator failed for H=(pEkHwfo) [77.83.39.181]:60188: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.2
country_id: 1269750
description:
2026-02-02 19:45:52 dovecot_login authenticator failed for H=([61.246.205.1]) [125.19.218.2]:44306: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 19:45:57 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47106: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:45:07 dovecot_login authenticator failed for H=(ptYowLU4vD) [77.83.39.61]:50091: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:45:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:45:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59892: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 167.94.146.50
country_id: 6252001
description:
2026-02-02 19:45:12 308492 [Warning] Aborted connection 308492 to db: 'unconnected' user: 'unauthenticated' host: '167.94.146.50' (This connection closed normally without authentication)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:45:08 dovecot_login authenticator failed for H=(pWJGcRTe) [77.83.39.61]:60747: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 164.92.215.178
country_id: 2750405
description:
Feb  2 19:45:30 sv3 pure-ftpd[2156451]: (?@164.92.215.178) [INFO] New connection from 164.92.215.178


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 19:46:08 H=(185.93.89.63) [185.93.89.63]:57408 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <diane@bethanyseacoast.com>: The mail server could not deliver mail to diane@bethanyseacoast.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:46:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:46:02 dovecot_login authenticator failed for H=(nLNntb) [77.83.39.61]:52752: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:46:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.38
country_id: 1269750
description:
2026-02-02 19:46:21 dovecot_login authenticator failed for H=(nsg-corporate-38.230.187.122.airtel.in) [122.187.230.38]:35499: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:46:06 dovecot_login authenticator failed for H=(j6LWw4g) [77.83.39.61]:62334: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:46:09 dovecot_login authenticator failed for H=(2VcVT8E) [77.83.39.181]:49226: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.163.127.14
country_id: 1269750
description:
2026-02-02 19:46:33 dovecot_login authenticator failed for H=(abts-north-dynamic-014.127.163.122.airtelbroadband.in) [122.163.127.14]:52904: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.43.137.90
country_id: 1835841
description:
2026-02-02 19:46:03 dovecot_login authenticator failed for H=([14.43.137.90]) [14.43.137.90]:35280: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:46:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56267: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:47:06 dovecot_login authenticator failed for H=(shOcCPa) [77.83.39.181]:53945: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:47:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:47:17 dovecot_login authenticator failed for H=(zjbMIV) [77.83.39.61]:52549: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 19:47:09 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (3BmfgFy) [34.101.116.145]:62287: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:47:15 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51932: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:47:16 dovecot_login authenticator failed for H=(d43KQMLHs) [77.83.39.61]:53915: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.58.242
country_id: 1835841
description:
2026-02-02 19:47:40 dovecot_login authenticator failed for H=([61.72.101.1]) [61.72.58.242]:59785: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.187
country_id: 2750405
description:
2026-02-02 19:47:24 308555 [Warning] Aborted connection 308555 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.187' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.94.66
country_id: 1269750
description:
2026-02-02 19:47:58 dovecot_login authenticator failed for H=([27.123.94.66]) [27.123.94.66]:48944: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:48:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65283: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:48:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:48:11 dovecot_login authenticator failed for H=(gvC76BuPz) [77.83.39.61]:59379: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:48:15 dovecot_login authenticator failed for H=(yFHXOkt7) [77.83.39.61]:50670: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 19:48:16 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (mp2Usi) [34.101.116.145]:63782: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:48:20 dovecot_login authenticator failed for H=(NLZdS8lxI) [77.83.39.181]:59795: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 19:48:35 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41682: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 19:49:39 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim@cofreth.com.my has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.114.243.83
country_id: 3625428
description:
2026-02-02 19:49:53 dovecot_login authenticator failed for H=([190.114.243.80]) [190.114.243.83]:39496: 535 Incorrect authentication data (set_id=postmaster@wohcheong.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:49:27 dovecot_login authenticator failed for H=(21C8M6RapN) [77.83.39.61]:55146: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:49:07 dovecot_login authenticator failed for H=(xcA7rTEBv) [77.83.39.61]:55870: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:49:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61738: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:49:16 dovecot_login authenticator failed for H=(ynsgyxkHde) [77.83.39.181]:63581: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:49:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 19:49:06 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (XioWOL) [34.101.116.145]:65069: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.16.98.91
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=48331514886497 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 19:50:59 +0800] info [cpaneld] 185.204.54.153 - mail "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mail (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 19:50:59 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38376: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:50:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:50:03 dovecot_login authenticator failed for H=(19WX71) [77.83.39.61]:65043: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.187
country_id: 2750405
description:
2026-02-02 19:50:03 308646 [Warning] Aborted connection 308646 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.187' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:50:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:50:24 dovecot_login authenticator failed for H=(BULgVsuyHS) [77.83.39.61]:55842: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 19:50:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim@cofreth.com.my has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-02-02 19:50:03 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:36296: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 19:50:14 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (MrsB0H) [34.101.116.145]:51454: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:50:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58104: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:50:11 dovecot_login authenticator failed for H=(dtonv19) [77.83.39.181]:51263: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 19:51:52 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 19:51:15 H=(185.93.89.63) [185.93.89.63]:58418 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <ffournier@greenbay.k12.wi.us>: host lookup did not complete


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:51:36 dovecot_login authenticator failed for H=(r6LYS4sV) [77.83.39.61]:53300: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-02 19:51:45 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:51:08 dovecot_login authenticator failed for H=(40V3HRNNy) [77.83.39.181]:55940: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:51:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:51:16 dovecot_login authenticator failed for H=(GVxYwye) [77.83.39.61]:63064: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:51:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54225: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 19:51:05 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (VTTZx0Sa) [34.101.116.145]:54864: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 19:51:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim@cofreth.com.my has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:51:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 19:52:13 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (r7VQeIxt79) [34.101.116.145]:58501: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:52:37 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53322: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 19:52:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth@cofreth.com.my has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 19:52:24 H=(185.93.89.63) [185.93.89.63]:58570 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <mshifrin@customcandydesign.com>: The mail server could not deliver mail to mshifrin@customcandydesign.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:52:33 dovecot_login authenticator failed for H=(bi2Oa6O) [77.83.39.61]:56575: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 35.233.95.0
country_id: 2802361
description:
Feb  2 19:52:36 sv3 pure-ftpd[2161453]: (?@35.233.95.0) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:52:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:52:12 dovecot_login authenticator failed for H=(rdhFKGHAD) [77.83.39.61]:64103: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/scripts/logo.dat||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-02-02 19:52:06 dovecot_plain authenticator failed for H=(phionch) [24.187.213.29]:50166: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:52:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:52:03 dovecot_login authenticator failed for H=(36szF6YKWE) [77.83.39.181]:60497: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 19:53:26 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59440: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 19:53:04 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (gBZ4vK) [34.101.116.145]:60543: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:53:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:53:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:53:18 dovecot_login authenticator failed for H=(UZOm2keU) [77.83.39.181]:51811: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.51.49.90
country_id: 3508796
description:
2026-02-02 19:53:20 dovecot_plain authenticator failed for H=(perbok) [38.51.49.90]:58539: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:53:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50763: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:53:44 dovecot_login authenticator failed for H=(4IknkYHDYQ) [77.83.39.61]:56002: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.193.51.205
country_id: 2077456
domain: masaakisb.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/masaakisb/public_html/wp-includes/images/wp-login.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 19:53:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim@cofreth.com.my has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:53:07 dovecot_login authenticator failed for H=(rI5YDacrB) [77.83.39.61]:55169: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/sysctl.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.35.19.230
country_id: 2658434
description:
2026-02-02 19:54:00 dovecot_plain authenticator failed for H=dhclient-212-35-19-230.flashcable.ch (agreatenes) [212.35.19.230]:52036: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 19:54:06 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.170.218.142
country_id: 1835841
description:
2026-02-02 19:54:07 dovecot_login authenticator failed for H=([121.170.218.142]) [121.170.218.142]:49421: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:54:14 dovecot_login authenticator failed for H=(G3CiT9oERl) [77.83.39.181]:56988: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:54:03 dovecot_login authenticator failed for H=(kSv5EQ93Ut) [77.83.39.61]:58247: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 19:54:07 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (jK1LUsK) [34.101.116.145]:63189: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:54:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 19:54:34 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:64229: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:54:42 dovecot_login authenticator failed for H=(JXfJrQ) [77.83.39.61]:58741: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 19:54:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth@cofreth.com.my has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:54:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:54:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64557: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/libuser.conf||User:root||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 19:54:03 H=(185.93.89.63) [185.93.89.63]:59116 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <joe.swain@chemicalbankmi.com>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 19:54:13 dovecot_login authenticator failed for H=(uCWo75rksl) [178.16.52.139]:57463: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.82.97.51
country_id: 1814991
description:
2026-02-02 19:54:22 dovecot_login authenticator failed for H=([223.82.97.51]) [223.82.97.51]:34625: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 19:55:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth@cofreth.com.my has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:55:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60888: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 19:55:53 H=(185.93.89.63) [185.93.89.63]:59400 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <roush_j@westcler.org>: host lookup did not complete


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/sudo.conf||User:root||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:55:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.78
country_id: 1733045
description:
2026-02-02 19:55:10 dovecot_login authenticator failed for H=([49.125.201.78]) [49.125.201.78]:45414: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 19:55:08 dovecot_login authenticator failed for H=(dL27Ksp3wQ) [178.16.52.139]:57480: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:55:10 dovecot_login authenticator failed for H=(8i57JE) [77.83.39.181]:61557: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-02-02 19:55:11 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:41480: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
country_id: 6251999
description:
2026-02-02 19:55:24 dovecot_login authenticator failed for H=s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:14076: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.129.90.215
country_id: 2921044
description:
2026-02-02 19:55:54 dovecot_login authenticator failed for H=ns3241969.ip-57-129-90.eu [57.129.90.215]:33918: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 19:55:03 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (eUUzTq) [34.101.116.145]:50169: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.100.159.2
country_id: 1835841
description:
2026-02-02 19:55:25 dovecot_login authenticator failed for H=([222.100.159.2]) [222.100.159.2]:54946: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 19:55:52 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51574: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:55:54 dovecot_login authenticator failed for H=(sKsU7zG4FP) [77.83.39.61]:50149: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13010
name: Delayed Multiple triggers of Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 19:55:57 H=(185.93.89.63) [185.93.89.63]:59420 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <jfadler@privatenursing.biz>: The mail server could not deliver mail to jfadler@privatenursing.biz.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:55:17 dovecot_login authenticator failed for H=(VO4ussz) [77.83.39.61]:64503: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:56:06 dovecot_login authenticator failed for H=(7zepVKu) [77.83.39.181]:49756: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:56:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:56:15 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56814: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.49.69
country_id: 6251999
description:
2026-02-02 19:56:38 dovecot_plain authenticator failed for H=([10.30.18.249]) [212.56.49.69]:38372: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 19:56:36 +0800] info [cpaneld] 185.204.54.153 - mssa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mssa (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 19:56:06 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (8k4pFf) [34.101.116.145]:52105: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 19:56:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth@cofreth.com.my has been locked for the attacker IP 34.101.116.145


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/named.root.key||User:root||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:56:51 dovecot_login authenticator failed for H=(5K8ceK) [77.83.39.61]:54967: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 19:56:06 dovecot_login authenticator failed for H=(phGnnz9KH) [178.16.52.139]:63138: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:56:13 dovecot_login authenticator failed for H=(QcTa8p4yn) [77.83.39.61]:54902: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.49.69
country_id: 6251999
description:
2026-02-02 19:57:03 dovecot_login authenticator failed for H=([10.30.18.249]) [212.56.49.69]:8634: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:57:03 dovecot_login authenticator failed for H=(B7fpmwxXAc) [77.83.39.181]:54442: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 19:57:03 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (FTt7NNVz5) [34.101.116.145]:54421: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/cpbackup-exclude.conf||User:root||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:57:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 19:57:07 dovecot_login authenticator failed for H=(tuU0rzffr) [178.16.52.139]:49715: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:57:08 dovecot_login authenticator failed for H=(WdACAjxUL) [77.83.39.61]:64435: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:57:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53489: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 19:57:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin@cofreth.com.my has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 80.82.70.133
country_id: 241170
description:
2026-02-02 19:57:25 309018 [Warning] Aborted connection 309018 to db: 'unconnected' user: 'unauthenticated' host: '80.82.70.133' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:58:03 dovecot_login authenticator failed for H=(Dbn0Umy) [77.83.39.61]:60364: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 19:58:15 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55744: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.46
country_id: 1269750
description:
2026-02-02 19:58:14 dovecot_login authenticator failed for H=([182.95.85.181]) [182.95.123.46]:60498: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:58:03 dovecot_login authenticator failed for H=(F0SrBMBw) [77.83.39.61]:60356: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:58:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 77.83.39.61


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib64/cracklib_dict.pwd||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 19:58:05 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (GK8hSgM1yJ) [34.101.116.145]:56906: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.44.40.82
country_id: 2017370
description:
2026-02-02 19:58:23 dovecot_login authenticator failed for H=([46.44.40.82]) [46.44.40.82]:60810: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-02 19:58:43 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 19:58:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin@cofreth.com.my has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.47.83.115
country_id: 732800
description:
2026-02-02 19:58:53 dovecot_plain authenticator failed for H=(comintanin) [46.47.83.115]:58099: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:58:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64894: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 19:58:09 dovecot_login authenticator failed for H=(GdgeGFj) [178.16.52.139]:62557: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:58:20 dovecot_login authenticator failed for H=(0cqb0d) [77.83.39.181]:61262: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:59:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:59:16 dovecot_login authenticator failed for H=(nz4mb9S) [77.83.39.61]:57654: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:59:16 dovecot_login authenticator failed for H=(UidfbyH0) [77.83.39.181]:49811: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/sestatus.conf||User:root||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 122.128.107.48
country_id: 1819730
description:
[2026-02-02 19:59:08 +0800] info [whostmgrd] 122.128.107.48 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:59:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57474: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 19:59:13 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (zFGKDl) [34.101.116.145]:59368: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 19:59:10 dovecot_login authenticator failed for H=(jwOpBQ) [178.16.52.139]:61707: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 19:59:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin@cofreth.com.my has been locked for the attacker IP 34.101.116.145


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/languages/images/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:00:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth@cofreth.com.my has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:00:07 dovecot_login authenticator failed for H=(vdzC0Offv) [178.16.52.139]:50146: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:00:11 dovecot_login authenticator failed for H=(m0ztnQBZtw) [77.83.39.61]:58961: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:00:13 dovecot_login authenticator failed for H=(Br4E9esRuJ) [77.83.39.181]:55122: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:00:30 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info@oxbold.com has been temporarily locked by Imunify PAM(77.83.39.181)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:00:10 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (ggwlj8) [34.101.116.145]:61509: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:00:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54228: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:00:52 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59266: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:00:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:00:08 H=(185.93.89.63) [185.93.89.63]:60291 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <svargo@fpfc.net>: The mail server could not deliver mail to svargo@fpfc.net.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.223.93.204
country_id: 1168579
description:
2026-02-02 20:00:56 dovecot_login authenticator failed for H=([127.0.0.1]) [163.223.93.204]:48802: 535 Incorrect authentication data (set_id=inf@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:00:04 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (LGiijyK) [34.101.116.145]:61131: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:01:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:01:04 dovecot_login authenticator failed for H=(9sxGCM) [178.16.52.139]:50264: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:01:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51041: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:01:07 dovecot_login authenticator failed for H=(GhyT7k) [77.83.39.61]:51399: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.97.131.248
country_id: 1605651
description:
2026-02-02 20:01:09 dovecot_login authenticator failed for H=ppp-171-97-131-248.revip8.asianet.co.th ([127.0.0.1]) [171.97.131.248]:40178: 535 Incorrect authentication data (set_id=inf)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:01:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin@cofreth.com.my has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:01:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info@oxbold.com has been temporarily locked by Imunify PAM(77.83.39.181)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:01:10 dovecot_login authenticator failed for H=(hquXk8) [77.83.39.181]:60432: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:01:07 dovecot_login authenticator failed for H=(OISyk8Z) [77.83.39.61]:58792: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:01:12 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (6SgKy1j6) [34.101.116.145]:64330: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.221.233
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/thumb.php?size=1000x1000&src=img/photos/6197804691.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-02-02 20:01:54 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:55050: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:02:05 dovecot_login authenticator failed for H=(2xyG77) [77.83.39.181]:64554: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:02:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info@oxbold.com has been temporarily locked by Imunify PAM(77.83.39.181)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:02:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:02:47 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60048: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:02:03 dovecot_login authenticator failed for H=(zzqc1ZZOUM) [77.83.39.61]:54607: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:02:03 dovecot_login authenticator failed for H=(DIkvj6o) [77.83.39.61]:54211: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:02:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth@cofreth.com.my has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:02:13 dovecot_login authenticator failed for H=(XzPvY8Oz) [178.16.52.139]:52450: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:02:03 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (V25kOXjbm) [34.101.116.145]:50060: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:03:43 dovecot_login authenticator failed for H=(LknTOCba) [77.83.39.61]:55220: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:03:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60048: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:03:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:03:16 dovecot_login authenticator failed for H=(G4ncmWO) [178.16.52.139]:63413: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:03:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info@oxbold.com has been temporarily locked by Imunify PAM(77.83.39.181)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:03:26 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43538: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 20:03:33 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:57798: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.149.43
country_id: 1880251
domain: mail.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/c-bible/images/resource/index.php||SC:/home2/fkrcom/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:03:06 dovecot_login authenticator failed for H=(g7otriZc5z) [77.83.39.61]:51875: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:03:11 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (tR91ZJk) [34.101.116.145]:53048: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:03:19 H=(185.93.89.63) [185.93.89.63]:60768 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <lwoodcox@plastictrends.com>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:03:20 dovecot_login authenticator failed for H=(sgvpeh) [77.83.39.181]:54379: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:03:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth@cofreth.com.my has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:04:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza has been locked for the attacker IP 77.83.39.61


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/images/sliders/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:04:16 dovecot_login authenticator failed for H=(Dno6FGJ1Id) [77.83.39.181]:58482: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:04:02 dovecot_login authenticator failed for H=(PXD7qWl) [178.16.52.139]:56259: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:04:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info@oxbold.com has been temporarily locked by Imunify PAM(77.83.39.181)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:04:38 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53377: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:04:02 dovecot_login authenticator failed for H=(JTUXJyyD) [77.83.39.61]:55470: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:04:02 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (WoaJ1lA) [34.101.116.145]:55856: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:04:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth@cofreth.com.my has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:04:39 dovecot_login authenticator failed for H=(Rhjct9Yl) [77.83.39.61]:65335: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:05:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:05:20 dovecot_login authenticator failed for H=(qCn5PnwKD) [178.16.52.139]:57556: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:05:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49249: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:05:39 dovecot_login authenticator failed for H=(UYi9T2J) [77.83.39.61]:53772: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-02 20:05:47 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:05:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin@cofreth.com.my has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:05:10 dovecot_login authenticator failed for H=(Sb8rAM9) [77.83.39.181]:62245: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:05:10 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (2rGZdC) [34.101.116.145]:58581: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:05:11 dovecot_login authenticator failed for H=(nk8brlPz) [77.83.39.61]:50281: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:05:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info@oxbold.com has been temporarily locked by Imunify PAM(77.83.39.181)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:05:20 H=(185.93.89.63) [185.93.89.63]:61294 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <cdgrace@csborbisonia.com>: The mail server could not deliver mail to cdgrace@csborbisonia.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:06:06 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (aYKS2nq) [34.101.116.145]:60656: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:06:55 dovecot_login authenticator failed for H=(8Xa9LXhQH) [77.83.39.61]:61272: 535 Incorrect authentication data (set_id=aipeng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.149.153.106
country_id: 3175395
description:
2026-02-02 20:06:56 dovecot_plain authenticator failed for H=(triels) [88.149.153.106]:55654: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:06:06 dovecot_login authenticator failed for H=(1kmclj97) [77.83.39.181]:50532: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:06:05 dovecot_login authenticator failed for H=(ORW1mK9v) [178.16.52.139]:51155: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:06:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:06:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61200: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-02 20:06:35 309488 [Warning] Aborted connection 309488 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.121.76.190
country_id: 732800
description:
2026-02-02 20:06:54 dovecot_plain authenticator failed for H=(ampulper) [87.121.76.190]:43397: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:06:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 20:06:11 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:06:10 dovecot_login authenticator failed for H=(ONZghZ) [77.83.39.61]:53560: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:06:07 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33912: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 141.98.10.106
country_id: 597427
description:
2026-02-02 20:07:24 H=([141.98.10.106]) [141.98.10.106]:52700 F=<mselhime@drake-scruggs.com> rejected RCPT <chuan@tschuan.com>: SPF: 141.98.10.106 is not allowed to send mail from drake-scruggs.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:07:02 dovecot_login authenticator failed for H=(nMbRBmIuGG) [77.83.39.181]:55463: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:07:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:07:07 dovecot_login authenticator failed for H=(Vazy9kcZ) [178.16.52.139]:49401: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:07:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin@cofreth.com.my has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:07:08 dovecot_login authenticator failed for H=(7h3Zvx) [77.83.39.61]:61975: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 20:07:21 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:07:09 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (z6BV8Nz) [34.101.116.145]:62865: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:07:36 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58197: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:08:03 dovecot_login authenticator failed for H=(WqwZyxtazQ) [77.83.39.61]:64003: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:08:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:08:16 dovecot_login authenticator failed for H=(hrxYZ3A) [77.83.39.181]:61059: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:08:17 H=(185.93.89.63) [185.93.89.63]:61724 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<mpnmjec@mpnmjec.ac.in> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <jmccoy@generationone.com>: The mail server could not deliver mail to jmccoy@generationone.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:08:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56978: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:08:18 dovecot_login authenticator failed for H=(fImYJC8iY) [178.16.52.139]:52821: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:08:21 dovecot_login authenticator failed for H=(NZUFTv) [77.83.39.61]:52507: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:08:32 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:08:36 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:58634: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 20:08:27 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (polocry) [87.103.126.54]:37381: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.17.96.29
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.aoto.com.my/product-detail.php?id=4111725259 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:08:05 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (isVsglJ) [34.101.116.145]:64882: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:08:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:09:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:09:22 dovecot_login authenticator failed for H=(5GFVEgf) [178.16.52.139]:53732: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:09:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


