# incident

plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 103.158.121.26
country_id: 1643084
domain: 42.0.28.25
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:7.71||T:APACHE||MV:.env.~||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:35:55 dovecot_login authenticator failed for H=(HIT0csXqm) [178.16.52.139]:59804: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:35:07 dovecot_login authenticator failed for H=(N2SytP) [178.16.52.139]:59074: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:35:29 dovecot_login authenticator failed for H=(lutKW4) [158.94.210.42]:64084: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 00:35:43 H=(185.93.89.63) [185.93.89.63]:49260 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <tressemann@entellusmedical.com>: The mail server could not deliver mail to tressemann@entellusmedical.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-02-03 00:35:28 dovecot_login authenticator failed for H=(v023sMj) [141.98.11.82]:59102: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:35:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51592: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.143
country_id: 2635167
description:
2026-02-03  0:35:24 326952 [Warning] Aborted connection 326952 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.143' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 00:36:53 H=(185.93.89.63) [185.93.89.63]:49429 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <perry.williams@consona.com>: The mail server could not deliver mail to perry.williams@consona.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2026-02-03 00:36:09 dovecot_plain authenticator failed for H=(othenes) [65.20.160.107]:48010: 535 Incorrect authentication data (set_id=callen@kimmark.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:36:18 dovecot_login authenticator failed for H=(I91a9HQnh) [178.16.52.139]:52692: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.71.9.31
country_id: 1835841
description:
2026-02-03 00:36:41 dovecot_login authenticator failed for H=([180.71.9.31]) [180.71.9.31]:45090: 535 Incorrect authentication data (set_id=contact@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 00:36:22 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52786: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.109.153.175
country_id: 1835841
description:
2026-02-03 00:36:51 dovecot_login authenticator failed for H=([183.109.153.175]) [183.109.153.175]:51185: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-02-03 00:36:20 dovecot_login authenticator failed for H=(9JsJBr) [141.98.11.82]:56867: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.210.42
country_id: 2750405
description:
Feb  3 00:36:25 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.210.42


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.143
country_id: 2635167
description:
2026-02-03  0:36:55 326994 [Warning] Aborted connection 326994 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.143' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:36:15 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62260: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2026-02-03 00:36:52 dovecot_login authenticator failed for H=([152.52.234.33]) [182.95.174.18]:38112: 535 Incorrect authentication data (set_id=contacto@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:36:27 dovecot_login authenticator failed for H=(2dT6an) [158.94.210.42]:50426: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.25.140.211
country_id: 1814991
description:
2026-02-03 00:37:11 dovecot_login authenticator failed for H=([112.25.140.211]) [112.25.140.211]:49281: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:37:28 dovecot_login authenticator failed for H=(uivG1sO) [158.94.210.42]:57130: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.86
country_id: 1269750
description:
2026-02-03 00:37:30 dovecot_login authenticator failed for H=([27.123.119.191]) [122.184.127.86]:51364: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 00:37:42 H=(185.93.89.63) [185.93.89.63]:49594 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <rralston@feeneynw.com>: The mail server could not deliver mail to rralston@feeneynw.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:37:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56602: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-02-03 00:37:08 dovecot_login authenticator failed for H=(9jBG3L9) [141.98.11.82]:49515: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 00:37:21 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 00:37:24 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.210.42
country_id: 2750405
description:
Feb  3 00:37:26 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.210.42


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.120
country_id: 1668284
description:
2026-02-03 00:37:43 dovecot_login authenticator failed for H=([101.13.4.120]) [101.13.4.120]:57290: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:37:03 dovecot_login authenticator failed for H=(Ya3GlIRB) [178.16.52.139]:63558: 535 Incorrect authentication data (set_id=ajpsales@essemgroup.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:38:05 dovecot_login authenticator failed for H=(3zE7ckdn) [178.16.52.139]:58350: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 00:38:30 H=(185.93.89.63) [185.93.89.63]:49841 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <pulland@ccspm.org>: The mail server could not deliver mail to pulland@ccspm.org.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:38:49 dovecot_login authenticator failed for H=(sRqQryx) [158.94.210.42]:64005: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:38:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52142: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.210.42
country_id: 2750405
description:
Feb  3 00:38:47 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.210.42


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:38:09 dovecot_login authenticator failed for H=(9ezL4c) [178.16.52.139]:64230: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-02-03 00:38:34 dovecot_login authenticator failed for H=(zBFjfQe7w) [141.98.11.82]:58178: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:39:07 dovecot_login authenticator failed for H=(mmc84079) [178.16.52.139]:49185: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.83.181.181
country_id: 6252001
description:
2026-02-03 00:39:14 dovecot_plain authenticator failed for H=c-68-83-181-181.hsd1.pa.comcast.net (adant) [68.83.181.181]:60560: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:39:18 dovecot_login authenticator failed for H=(UETS0OR0) [158.94.210.42]:56965: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 00:39:22 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46740: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:39:36 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55802: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:39:43 dovecot_login authenticator failed for H=(soweME) [178.16.52.139]:57316: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 00:39:19 H=(185.93.89.63) [185.93.89.63]:50072 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <madeline.heaslip@duluth.k12.mn.us>: The mail server could not deliver mail to madeline.heaslip@duluth.k12.mn.us.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-02-03 00:39:57 dovecot_login authenticator failed for H=(yxYQehmPf) [141.98.11.82]:52580: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.210.42
country_id: 2750405
description:
Feb  3 00:39:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.210.42


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 00:39:17 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2026-02-03 00:39:19 dovecot_plain authenticator failed for H=c-73-137-7-97.hsd1.ga.comcast.net (poderid) [73.137.7.97]:57190: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:40:12 dovecot_login authenticator failed for H=(35CkD6cql) [178.16.52.139]:59428: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 00:40:53 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.210.42
country_id: 2750405
description:
Feb  3 00:40:55 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.210.42


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-02-03 00:40:21 dovecot_login authenticator failed for H=(JLD4xLB) [141.98.11.82]:57752: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:40:22 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64971: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:40:57 dovecot_login authenticator failed for H=(WfMVN3Z8q) [158.94.210.42]:59999: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.33
country_id: 1733045
description:
2026-02-03 00:41:03 dovecot_login authenticator failed for H=([127.0.0.1]) [49.124.152.33]:46386: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.194.188.174
country_id: 3996063
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/5773924170.jpg&size=1000x1000 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 00:40:06 H=(185.93.89.63) [185.93.89.63]:50175 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <madeline.heaslip@duluth.k12.mn.us>: The mail server could not deliver mail to madeline.heaslip@duluth.k12.mn.us.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-02-03 00:41:06 dovecot_login authenticator failed for H=(yXEWkXR) [141.98.11.82]:64128: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:41:06 dovecot_login authenticator failed for H=(qQ8MDa) [178.16.52.139]:58018: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:41:23 dovecot_login authenticator failed for H=(lvalbF5F0l) [178.16.52.139]:52339: 535 Incorrect authentication data (set_id=ajpsales@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:41:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57673: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.124
country_id: 1819730
description:
2026-02-03 00:41:19 dovecot_login authenticator failed for H=(182.239.78.124.hk.chinamobile.com) [182.239.78.124]:45464: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.178.25
country_id: 298795
description:
2026-02-03 00:41:10 dovecot_login authenticator failed for H=([188.59.178.25]) [188.59.178.25]:60059: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.205.27.223
country_id: 1562822
description:
2026-02-03 00:41:12 dovecot_login authenticator failed for H=([127.0.0.1]) [203.205.27.223]:49209: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.169.148.186
country_id: 2963597
domain: imax.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home2/imaxcom/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:41:32 dovecot_login authenticator failed for H=(n03Dikg) [158.94.210.42]:60818: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:42:05 dovecot_login authenticator failed for H=(ye8SSrY) [178.16.52.139]:59404: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-02-03 00:42:39 dovecot_login authenticator failed for H=(F8OLFEFvf) [141.98.11.82]:49886: 535 Incorrect authentication data (set_id=wilson@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.249.167.42
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/we/8/342/846773 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 00:42:09 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56214: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:42:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51249: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 00:42:28 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:42:01 dovecot_login authenticator failed for H=(r7F01fMh) [158.94.210.42]:64725: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 00:42:01 H=(185.93.89.63) [185.93.89.63]:50451 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <lisa.parish@staff.spartaschools.org>: The mail server could not deliver mail to lisa.parish@staff.spartaschools.org.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:43:04 dovecot_login authenticator failed for H=(Ai7Cbi) [178.16.52.139]:60147: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:43:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62680: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:43:31 dovecot_login authenticator failed for H=(t0fYjR5s0Z) [158.94.210.42]:62512: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:43:39 dovecot_login authenticator failed for H=(tEx8Uze23) [178.16.52.139]:52583: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-02-03 00:43:24 dovecot_login authenticator failed for H=(1ZBC8aynz) [141.98.11.82]:52167: 535 Incorrect authentication data (set_id=wilson@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:44:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57674: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.167.75.86
country_id: 1814991
description:
2026-02-03 00:44:10 dovecot_login authenticator failed for H=([223.167.75.86]) [223.167.75.86]:51540: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 00:44:38 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:45704: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-02-03 00:44:13 dovecot_login authenticator failed for H=(FReC6KQX) [141.98.11.82]:63309: 535 Incorrect authentication data (set_id=wilson@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:44:16 dovecot_login authenticator failed for H=(y5Ubou6) [178.16.52.139]:59087: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:44:26 dovecot_login authenticator failed for H=(uBVHOs0C) [158.94.210.42]:59045: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.170.156.248
country_id: 6251999
description:
2026-02-03 00:44:21 dovecot_login authenticator failed for H=host-148-170-156-248.public.eastlink.ca [148.170.156.248]:33604: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 00:44:45 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:45:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62116: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-02-03 00:45:30 dovecot_login authenticator failed for H=(0bIiEmP) [141.98.11.82]:50393: 535 Incorrect authentication data (set_id=wilson@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:45:32 dovecot_login authenticator failed for H=(phQUXnE) [158.94.210.42]:57782: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.220.97.188
country_id: 6252001
description:
2026-02-03 00:45:58 dovecot_login authenticator failed for H=c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:41188: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-03  0:45:15 327919 [Warning] Aborted connection 327919 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 00:45:26 H=(185.93.89.63) [185.93.89.63]:51191 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <chuwongc@ipfw.edu>: The mail server could not deliver mail to chuwongc@ipfw.edu.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.193.210.80
country_id: 1835841
description:
2026-02-03 00:45:49 dovecot_login authenticator failed for H=([211.193.210.80]) [211.193.210.80]:48934: 535 Incorrect authentication data (set_id=office@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:45:02 dovecot_login authenticator failed for H=(gTX4jHSu8) [178.16.52.139]:50865: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.114
country_id: 1269750
description:
2026-02-03 00:46:43 dovecot_login authenticator failed for H=(nsg-corporate-17.50.186.122.airtel.in) [182.95.61.114]:34350: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:46:33 dovecot_login authenticator failed for H=(w0B8DDLmb) [178.16.52.139]:60189: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:46:12 dovecot_login authenticator failed for H=(Hxxrfv) [178.16.52.139]:59235: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-02-03 00:46:37 dovecot_login authenticator failed for H=(iIqylc) [141.98.11.82]:51818: 535 Incorrect authentication data (set_id=wilson@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:46:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57034: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.8.170
country_id: 2017370
description:
2026-02-03 00:46:58 dovecot_login authenticator failed for H=([31.173.8.170]) [31.173.8.170]:45922: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:46:55 dovecot_login authenticator failed for H=(RRjZ7L2) [158.94.210.42]:62288: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-03 00:46:30 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:53851: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.182.185.63
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=14641514945247 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-02-03 00:47:45 dovecot_login authenticator failed for H=(uSaLbY2n) [141.98.11.82]:59256: 535 Incorrect authentication data (set_id=wilson@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 00:47:03 H=(185.93.89.63) [185.93.89.63]:51420 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <tgarcia@roanoketrade.com>: The mail server could not deliver mail to tgarcia@roanoketrade.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.168.60
country_id: 1861060
domain: kdiballoon.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/kdiballo1/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:47:04 dovecot_login authenticator failed for H=(rUOZzhMi) [178.16.52.139]:65441: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 00:47:16 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 00:47:28 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57672: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:47:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53841: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:47:21 dovecot_login authenticator failed for H=(H0f5wJ) [158.94.210.42]:50768: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.217
country_id: 6252001
description:
2026-02-03  0:48:26 328099 [Warning] Aborted connection 328099 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.217' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-02-03 00:48:30 dovecot_login authenticator failed for H=(16h332JMKw) [141.98.11.82]:56742: 535 Incorrect authentication data (set_id=wilson@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:48:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60242: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:48:10 dovecot_login authenticator failed for H=(NNQzuwVkV) [178.16.52.139]:58544: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.197.178.198
country_id: 1835841
description:
2026-02-03 00:48:13 dovecot_login authenticator failed for H=([119.197.178.198]) [119.197.178.198]:44520: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:48:11 dovecot_login authenticator failed for H=(wGiZbuLjDS) [158.94.210.42]:49428: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 00:48:13 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.34
country_id: 1269750
description:
2026-02-03 00:48:46 dovecot_login authenticator failed for H=(nsg-corporate-34.230.187.122.airtel.in) [122.187.230.34]:47007: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 00:49:59 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.178.70
country_id: 1269750
description:
2026-02-03 00:49:37 dovecot_login authenticator failed for H=([182.79.95.167]) [122.185.178.70]:57398: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.180.19
country_id: 337996
description:
2026-02-03 00:49:15 dovecot_login authenticator failed for H=([196.190.180.18]) [196.190.180.19]:15433: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.69.36.172
country_id: 1562822
description:
2026-02-03 00:49:21 dovecot_login authenticator failed for H=([118.69.36.172]) [118.69.36.172]:53086: 535 Incorrect authentication data (set_id=support@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-02-03 00:49:35 dovecot_login authenticator failed for H=(3mtq8VS) [141.98.11.82]:63270: 535 Incorrect authentication data (set_id=wilson@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:49:12 dovecot_login authenticator failed for H=(0iIgXqVX) [158.94.210.42]:53433: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:49:16 dovecot_login authenticator failed for H=(VGx84gR8K) [178.16.52.139]:52713: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:49:11 dovecot_login authenticator failed for H=(cPmP8YMJ) [178.16.52.139]:60623: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:49:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56847: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.114
country_id: 1269750
description:
2026-02-03 00:49:32 dovecot_login authenticator failed for H=(aes-static-065.58.246.61.airtel.in) [182.95.184.114]:46870: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 00:49:55 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:37474: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-03 00:50:26 +0800] info [cpaneld] 185.204.54.153 - maalloys "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maalloys (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:50:12 dovecot_login authenticator failed for H=(d78oapZBv) [158.94.210.42]:57673: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 31.210.50.115
country_id: 298795
domain: achieversvisionacademy.com
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wadminw||User:achieversvisiona||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:50:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51897: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 00:50:44 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 00:50:10 H=(185.93.89.63) [185.93.89.63]:52127 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <dblecha@greenbay.k12.wi.us>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.92.130.3
country_id: 1814991
description:
2026-02-03 00:50:26 dovecot_login authenticator failed for H=([127.0.0.1]) [211.92.130.3]:58729: 535 Incorrect authentication data (set_id=kumara.rao)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.105.67.246
country_id: 2017370
description:
2026-02-03 00:50:18 dovecot_login authenticator failed for H=([127.0.0.1]) [79.105.67.246]:45824: 535 Incorrect authentication data (set_id=kumara.rao@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:50:02 dovecot_login authenticator failed for H=(u1zWyD42u) [178.16.52.139]:62176: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:51:35 dovecot_login authenticator failed for H=(lcLGNq) [158.94.210.42]:59675: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.213.177.101
country_id: 1668284
description:
2026-02-03 00:51:57 dovecot_login authenticator failed for H=([127.0.0.1]) [49.213.177.101]:60636: 535 Incorrect authentication data (set_id=inf)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:51:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63319: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.151.218.15
country_id: 1522867
description:
2026-02-03 00:51:50 dovecot_login authenticator failed for H=([127.0.0.1]) [37.151.218.15]:46271: 535 Incorrect authentication data (set_id=inf@imax.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:51:12 dovecot_login authenticator failed for H=(oknZbu) [178.16.52.139]:51688: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:51:25 dovecot_login authenticator failed for H=(iUwwUo) [178.16.52.139]:52566: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 00:52:37 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.119.203.139
country_id: 1269750
domain: tschuan.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:70944.tschuan.com||ServerName:tschuan.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d35521e546f081d1aa7bd7bdffbc2bf8c2a8fd65||Title:0xdf7fbae1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.122
country_id: 1269750
description:
2026-02-03 00:52:26 dovecot_login authenticator failed for H=([128.185.80.65]) [182.95.52.122]:47308: 535 Incorrect authentication data (set_id=contact@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 00:52:29 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55568: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:52:06 dovecot_login authenticator failed for H=(QHCOen) [178.16.52.139]:50255: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.120.50
country_id: 1269750
description:
2026-02-03 00:52:36 dovecot_login authenticator failed for H=(nsg-static-89.234.75.182-airtel.com) [182.95.120.50]:34280: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:52:37 dovecot_login authenticator failed for H=(RfZGeYUH) [158.94.210.42]:63553: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 00:52:08 H=(185.93.89.63) [185.93.89.63]:52415 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <nzylla@smithmicrotech.com>: The mail server could not deliver mail to nzylla@smithmicrotech.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:52:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50400: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:53:34 dovecot_login authenticator failed for H=(5KmbuczGe) [158.94.210.42]:52527: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:53:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60798: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 00:53:17 H=(185.93.89.63) [185.93.89.63]:52672 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <bgumm@econoheat.us>: The mail server could not deliver mail to bgumm@econoheat.us.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:53:13 dovecot_login authenticator failed for H=(e26sFUI) [178.16.52.139]:50157: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 00:54:57 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57536: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:54:12 dovecot_login authenticator failed for H=(vNuS7Af) [178.16.52.139]:61041: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:54:16 dovecot_login authenticator failed for H=(tFuXgnU) [178.16.52.139]:63490: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:54:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53778: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.58.78.206
country_id: 1269750
domain: oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/oxbold.com/waterraftingmalaysia-howtogetthere.htm HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:54:58 dovecot_login authenticator failed for H=(mFGFpsiM) [158.94.210.42]:64646: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/demos/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 00:54:13 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:55:19 dovecot_login authenticator failed for H=(a3j9uhQ) [178.16.52.139]:62147: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-03 00:55:45 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:52523: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-02-03 00:55:39 dovecot_login authenticator failed for H=(azteca-comunicaciones.com) [201.46.124.0]:1132: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 00:55:47 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.12
country_id: 6252001
description:
Feb  3 00:55:19 sv3 pure-ftpd[2399788]: (?@147.185.132.12) [INFO] New connection from 147.185.132.12


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.121
country_id: 6252001
description:
2026-02-03 00:55:30 dovecot_login authenticator failed for H=([209.23.72.121]) [209.23.72.121]:40654: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:55:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49198: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:56:22 dovecot_login authenticator failed for H=(LFxv0uF) [158.94.210.42]:53457: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 00:56:46 H=(185.93.89.63) [185.93.89.63]:53356 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <ech@meco-cesg.com>: The mail server could not deliver mail to ech@meco-cesg.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:56:23 dovecot_login authenticator failed for H=(SdfDimeltU) [178.16.52.139]:50645: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:56:03 dovecot_login authenticator failed for H=(R0AW5wCZZF) [178.16.52.139]:50336: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:56:17 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60127: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:57:41 dovecot_login authenticator failed for H=(kCt43VFkOD) [158.94.210.42]:61375: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 00:57:54 H=(185.93.89.63) [185.93.89.63]:53584 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <rrogoff@ocpm.edu>: The mail server could not deliver mail to rrogoff@ocpm.edu.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:57:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55991: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:57:09 dovecot_login authenticator failed for H=(MhOtQqFLo) [178.16.52.139]:60225: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 00:57:24 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41862: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 00:57:22 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:58:11 dovecot_login authenticator failed for H=(BbUZHHrUaS) [158.94.210.42]:65116: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:58:15 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50829: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:58:29 dovecot_login authenticator failed for H=(4IjZZd) [178.16.52.139]:58454: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:58:10 dovecot_login authenticator failed for H=(mqe04S) [178.16.52.139]:62919: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 47.187.155.36
country_id: 6252001
domain: tst-ma.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:83074.tst-ma.com||ServerName:tst-ma.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ad0b131decb863e1d1f1eac947a4f7b9b7a31bc6||Title:0xff492c36||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.235.225.31
country_id: 2017370
description:
2026-02-03 00:59:03 dovecot_login authenticator failed for H=([127.0.0.1]) [37.235.225.31]:37046: 535 Incorrect authentication data (set_id=meemee@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.115.147.147
country_id: 1835841
description:
2026-02-03 00:59:11 dovecot_login authenticator failed for H=([127.0.0.1]) [211.115.147.147]:56358: 535 Incorrect authentication data (set_id=meemee)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 00:59:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account euratech@euratech.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 00:59:39 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41252: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:59:04 dovecot_login authenticator failed for H=(0Uwc0dAEo) [178.16.52.139]:62608: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:59:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63844: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13010
name: Delayed Multiple triggers of Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 00:59:27 H=(185.93.89.63) [185.93.89.63]:53973 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <jasonhappel@rollinspci.com>: The mail server could not deliver mail to jasonhappel@rollinspci.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:59:48 dovecot_login authenticator failed for H=(1NHYVrKpOc) [158.94.210.42]:54268: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:00:06 dovecot_login authenticator failed for H=(7SqvvHOl) [178.16.52.139]:65465: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 01:00:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account euratech@euratech.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 01:00:37 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:00:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57018: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.191.33
country_id: 6252001
description:
2026-02-03 01:00:03 dovecot_plain authenticator failed for H=c-73-0-191-33.hsd1.fl.comcast.net (herrus) [73.0.191.33]:39856: 535 Incorrect authentication data (set_id=bak@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 01:00:18 dovecot_login authenticator failed for H=(c9wVewnalR) [158.94.210.42]:54328: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:00:52 dovecot_login authenticator failed for H=(GcmkpOEroG) [178.16.52.139]:54037: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 01:02:00 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35524: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:01:08 dovecot_login authenticator failed for H=(Q2ONgHX) [178.16.52.139]:62878: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.148.138
country_id: 732800
description:
2026-02-03 01:01:16 dovecot_plain authenticator failed for H=84-238-148-138.ip.btc-net.bg (unked) [84.238.148.138]:34982: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:01:21 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50228: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 01:01:24 dovecot_login authenticator failed for H=(xhcHXOJ) [158.94.210.42]:49697: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 01:01:32 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account euratech@euratech.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 01:02:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account euratech@euratech.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.249.26.230
country_id: 6252001
description:
2026-02-03 01:02:22 H=([104.249.26.230]) [104.249.26.230]:61402 F=<procurement@sumitomochemicalamerica.com> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:02:24 dovecot_login authenticator failed for H=(Ix7pIDYHP) [178.16.52.139]:56848: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 01:02:38 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 01:02:05 dovecot_login authenticator failed for H=(s0l9dPD) [158.94.210.42]:57553: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:02:16 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60545: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 01:03:37 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account euratech@euratech.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:03:14 dovecot_login authenticator failed for H=(D6Jh4u) [178.16.52.139]:63308: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.12.168.237
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phar-io/manifest/examples/example-01.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 01:03:54 dovecot_login authenticator failed for H=(w6bCoc1) [158.94.210.42]:53706: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:03:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57177: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:03:19 dovecot_login authenticator failed for H=(q35O9vqo) [178.16.52.139]:65532: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:04:21 dovecot_login authenticator failed for H=(ZXNG1w) [178.16.52.139]:54168: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-03 01:04:31 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:52617: 535 Incorrect authentication data (set_id=cass@kendek.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 01:04:37 H=(185.93.89.63) [185.93.89.63]:55035 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <sudelhoven@kesa.org>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:04:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51410: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 01:04:14 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:42358: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 01:04:28 dovecot_login authenticator failed for H=(GfPZLQ7Q) [158.94.210.42]:51476: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:05:38 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57088: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.190.238.234
country_id: 2017370
description:
2026-02-03 01:06:01 dovecot_login authenticator failed for H=(91-190-238-234.in-addr.netone.ru) [91.190.238.234]:48016: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 01:05:25 dovecot_login authenticator failed for H=(j7Tcuc) [158.94.210.42]:55379: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:05:55 dovecot_login authenticator failed for H=(65dYb21CU) [178.16.52.139]:53976: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:05:14 dovecot_login authenticator failed for H=(S08hRD) [178.16.52.139]:49441: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.194.128.158
country_id: 1269750
description:
2026-02-03 01:06:06 dovecot_login authenticator failed for H=(static-158.128.194.14-tataidc.co.in) [14.194.128.158]:53672: 535 Incorrect authentication data (set_id=admin@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 01:06:24 dovecot_login authenticator failed for H=(rG01ERaF) [158.94.210.42]:64747: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.130.98.240
country_id: 1668284
description:
2026-02-03 01:06:28 dovecot_login authenticator failed for H=(098240.CAGR.ncyu.edu.tw) [140.130.98.240]:47301: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:06:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50283: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.137
country_id: 1819730
description:
2026-02-03 01:06:41 dovecot_login authenticator failed for H=137.173.198.203.static.netvigator.com [203.198.173.137]:37597: 535 Incorrect authentication data (set_id=sales@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.161.232.9
country_id: 6252001
description:
2026-02-03 01:06:50 dovecot_login authenticator failed for H=ip98-161-232-9.ph.ph.cox.net [98.161.232.9]:39410: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:06:07 dovecot_login authenticator failed for H=(kUtXVW) [178.16.52.139]:52974: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.87.90.186
country_id: 3923057
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=181970 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/apache2/conf.d/php_add_handler_fix.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 01:06:27 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43926: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 01:07:02 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:07:20 dovecot_login authenticator failed for H=(Lq7fXbZaYs) [178.16.52.139]:57587: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:07:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60319: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 01:07:25 dovecot_login authenticator failed for H=(CcsSkpF) [158.94.210.42]:58269: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2026-02-03 01:07:54 dovecot_login authenticator failed for H=(static.ill.117.211.15.93.bsnl.co.in) [117.211.15.93]:57328: 535 Incorrect authentication data (set_id=postmaster@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.94.39.65
country_id: 1269750
description:
2026-02-03 01:08:04 dovecot_login authenticator failed for H=([59.94.39.65]) [59.94.39.65]:33707: 535 Incorrect authentication data (set_id=postmaster)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/lib/tmpfiles.d/setup.conf||User:root||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 01:08:15 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:08:22 dovecot_login authenticator failed for H=(JqWe8lIgh) [178.16.52.139]:58492: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 01:08:27 dovecot_login authenticator failed for H=(egSgGTcU) [158.94.210.42]:62567: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:08:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65470: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 01:08:39 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:37164: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/opt/scripts/lock.sh.old||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-02-03 01:09:17 dovecot_plain authenticator failed for H=(agments) [154.144.243.93]:59650: 535 Incorrect authentication data (set_id=fasya@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 01:09:26 dovecot_login authenticator failed for H=(2DWNs8) [158.94.210.42]:64011: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 177.200.33.115
country_id: 3469034
domain: u-net.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:63799.u-net.com.my||ServerName:u-net.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9e82f070bd53f16f3723e567706d88a7af606e5f||Title:0x9644bc7a||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.195.94.243
country_id: 2017370
description:
2026-02-03 01:09:15 dovecot_login authenticator failed for H=([217.195.94.243]) [217.195.94.243]:50798: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:09:16 dovecot_login authenticator failed for H=(2W03n8) [178.16.52.139]:55976: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:09:14 dovecot_login authenticator failed for H=(1ZdWi5dUTa) [178.16.52.139]:60211: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.210.42
country_id: 2750405
description:
Feb  3 01:09:50 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 158.94.210.42


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.212.54
country_id: 99237
description:
2026-02-03 01:09:05 dovecot_login authenticator failed for H=([62.201.212.54]) [62.201.212.54]:49948: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:09:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63593: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 01:10:12 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 01:11:00 dovecot_login authenticator failed for H=(jKl5aE) [158.94.210.42]:62632: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:10:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57979: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/tmpfiles.d/rpcbind.conf||User:root||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 01:10:29 H=(185.93.89.63) [185.93.89.63]:56127 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <ellen.peevler@provena.org>: The mail server could not deliver mail to ellen.peevler@provena.org.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 185.93.89.102
country_id: 130758
description:
Feb  3 01:10:40 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info@oxbold.com has been temporarily locked by Imunify PAM(185.93.89.102)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:10:08 dovecot_login authenticator failed for H=(Ul7jikUQIv) [178.16.52.139]:51163: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 01:10:03 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 01:10:56 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39182: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.240
country_id: 6252001
description:
Feb  3 01:10:02 sv3 pure-ftpd[2413051]: (?@147.185.132.240) [INFO] New connection from 147.185.132.240


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.235.133.43
country_id: 2589581
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=673988 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:11:26 dovecot_login authenticator failed for H=(IRDYA5JyeM) [178.16.52.139]:56087: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 145.241.192.248
country_id: 2635167
description:
2026-02-03 01:11:22 dovecot_login authenticator failed for H=([127.0.0.1]) [145.241.192.248]:39528: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.202.155.17
country_id: 1814991
description:
2026-02-03 01:11:42 dovecot_login authenticator failed for H=([127.0.0.1]) [124.202.155.17]:65147: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2026-02-03 01:11:52 dovecot_plain authenticator failed for H=c-73-196-144-25.hsd1.nj.comcast.net (shirphot) [73.196.144.25]:51196: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.217.180.34
country_id: 1835841
domain: kimmark.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/kimmark/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 01:11:29 dovecot_login authenticator failed for H=(HbPyUj) [158.94.210.42]:59843: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 73.196.144.25
country_id: 6252001
description:
Feb  3 01:11:50 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info@oxbold.com has been temporarily locked by Imunify PAM(73.196.144.25)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:11:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51755: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/i360-php-opts/module.ini||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.151.218.15
country_id: 1522867
description:
2026-02-03 01:11:43 dovecot_login authenticator failed for H=([127.0.0.1]) [37.151.218.15]:52563: 535 Incorrect authentication data (set_id=aniza)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/root/usr/lib64/cracklib_dict.pwd||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:12:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55700: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.221.48.178
country_id: 2017370
description:
2026-02-03 01:12:42 dovecot_login authenticator failed for H=([127.0.0.1]) [95.221.48.178]:58291: 535 Incorrect authentication data (set_id=inf)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.184.29.112
country_id: 953987
description:
2026-02-03 01:12:35 dovecot_login authenticator failed for H=([127.0.0.1]) [105.184.29.112]:47673: 535 Incorrect authentication data (set_id=inf@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:12:46 dovecot_login authenticator failed for H=(soqf1e) [178.16.52.139]:60636: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2026-02-03 01:12:46 dovecot_plain authenticator failed for H=(ingleglow) [199.192.123.12]:56738: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 01:13:08 dovecot_login authenticator failed for H=(lev0x32) [158.94.210.42]:61922: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:13:15 dovecot_login authenticator failed for H=(NOFa9954oV) [178.16.52.139]:56975: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:13:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53487: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-03 01:14:01 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:54651: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 01:13:03 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47548: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/apache2/conf.d/ssl.key||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:13:23 dovecot_login authenticator failed for H=(f2VoNvpv44) [178.16.52.139]:52045: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 01:14:46 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/apache2/conf.d/includes/pre_main_1.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:14:17 dovecot_login authenticator failed for H=(ScmEgLWk) [178.16.52.139]:62269: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 01:14:22 H=(185.93.89.63) [185.93.89.63]:56974 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <jgodish@dpg.devry.edu>: The mail server could not deliver mail to jgodish@dpg.devry.edu.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 01:14:30 dovecot_login authenticator failed for H=(LQiK98aC) [158.94.210.42]:63331: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/es/images/contact.php||SC:/home/indfinitydesign/public_html/es||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:14:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62677: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 01:15:34 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 01:15:02 dovecot_login authenticator failed for H=(AvbC12HKA8) [158.94.210.42]:57667: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:15:10 dovecot_login authenticator failed for H=(F9nnCflje) [178.16.52.139]:55945: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:15:11 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56860: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 80.82.70.133
country_id: 241170
description:
2026-02-03  1:15:23 330513 [Warning] Aborted connection 330513 to db: 'unconnected' user: 'unauthenticated' host: '80.82.70.133' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 01:15:54 H=(185.93.89.63) [185.93.89.63]:57254 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <earl_trachsel@southern-cal.k12.ia.us>: The mail server could not deliver mail to earl_trachsel@southern-cal.k12.ia.us.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 01:15:16 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43692: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 01:16:47 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/cl.selector/php.extensions.d/i360.cfg||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:16:27 dovecot_login authenticator failed for H=(9sdNnJyIG) [178.16.52.139]:54738: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 01:16:07 dovecot_login authenticator failed for H=(qj13ARSFNs) [158.94.210.42]:49222: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.28.202.68
country_id: 2077456
domain: mokshana.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/m.php||SC:/home/mokshanacom/public_html/images/m.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 01:16:43 H=(185.93.89.63) [185.93.89.63]:57377 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <mnoll@eds.com>: The mail server could not deliver mail to mnoll@eds.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:16:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52203: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/demos/img/img/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 01:17:33 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50718: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-03 01:17:42 dovecot_login authenticator failed for H=(oGPQsPuTj6) [146.70.146.50]:51338: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/dbus-1/system.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.106.155
country_id: 3469034
description:
2026-02-03 01:17:40 dovecot_login authenticator failed for H=(177-174-106-155.user.vivozap.com.br) [177.174.106.155]:50218: 535 Incorrect authentication data (set_id=info@wohcheong.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 01:17:18 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 01:17:26 H=(185.93.89.63) [185.93.89.63]:57485 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <mnoll@eds.com>: The mail server could not deliver mail to mnoll@eds.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:17:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62490: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 01:17:07 dovecot_login authenticator failed for H=(5Gh9Me) [158.94.210.42]:64704: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.62.73.218
country_id: 1835841
description:
2026-02-03 01:17:49 dovecot_login authenticator failed for H=([211.62.73.218]) [211.62.73.218]:55159: 535 Incorrect authentication data (set_id=info@wohcheong.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.206.76
country_id: 1562822
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.tptec.com.my/products.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:17:16 dovecot_login authenticator failed for H=(7GEQllQLP) [178.16.52.139]:60273: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.130
country_id: 1269750
description:
2026-02-03 01:18:48 dovecot_login authenticator failed for H=([152.52.238.88]) [182.95.184.130]:57022: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:18:11 dovecot_login authenticator failed for H=(mi85mCIjZ) [178.16.52.139]:54263: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/demos/img/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 01:18:40 dovecot_login authenticator failed for H=(E3XgsH) [158.94.210.42]:63322: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-03 01:18:05 dovecot_login authenticator failed for H=(M1bZep) [146.70.146.50]:49509: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.15.224.102
country_id: 1814991
description:
2026-02-03 01:18:12 dovecot_login authenticator failed for H=([218.15.224.102]) [218.15.224.102]:45373: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 01:18:12 H=(185.93.89.63) [185.93.89.63]:57644 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <jayala@bordermetalstamping.com>: The mail server could not deliver mail to jayala@bordermetalstamping.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.88.129.112
country_id: 1522867
description:
2026-02-03 01:18:24 dovecot_login authenticator failed for H=178.88.129.112.dynamic.telecom.kz [178.88.129.112]:52578: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:18:34 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53326: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:19:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49650: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:19:30 dovecot_login authenticator failed for H=(w9Jo6LIZL) [178.16.52.139]:56542: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 01:19:52 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 01:19:51 H=(185.93.89.63) [185.93.89.63]:58044 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <jdelucia@glts.tec.ma.us>: host lookup did not complete


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.64.93.161
country_id: 2077456
description:
2026-02-03 01:19:03 dovecot_login authenticator failed for H=115-64-93-161.tpgi.com.au [115.64.93.161]:59626: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.170.117
country_id: 3175395
description:
2026-02-03 01:19:03 dovecot_plain authenticator failed for H=([100.64.100.6]) [2.57.170.117]:16246: 535 Incorrect authentication data (set_id=hrd@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 01:19:16 dovecot_login authenticator failed for H=(NIDoRa) [158.94.210.42]:54218: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 01:19:47 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44380: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/i360-php-opts/cagefs.ini||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-03 01:19:05 dovecot_login authenticator failed for H=(V8CMy8) [146.70.146.50]:56201: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-03 01:20:05 dovecot_login authenticator failed for H=(uqMBv0g) [146.70.146.50]:61723: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 01:20:10 dovecot_login authenticator failed for H=(muJhZQTgfz) [158.94.210.42]:63547: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:20:18 dovecot_login authenticator failed for H=(zDvDYN) [178.16.52.139]:62256: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:20:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57320: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.154.92.163
country_id: 2017370
description:
2026-02-03 01:20:32 dovecot_login authenticator failed for H=([194.154.92.163]) [194.154.92.163]:57304: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  3 01:20:59 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent@a-connect.global has been locked for the attacker IP 146.70.146.50


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.182.145.224
country_id: 3469034
domain: usfood.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:35283.usfood.com.my||ServerName:usfood.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:57a059e52593c30e2e340bedff5bcf5c40baac13||Title:0x712a1221||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.146.93.14
country_id: 1668284
description:
2026-02-03 01:20:18 dovecot_login authenticator failed for H=(122-146-93-14.adsl.static.sparqnet.net) [122.146.93.14]:52784: 535 Incorrect authentication data (set_id=sales@wohcheong.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/run/NetworkManager/resolv.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.182.49
country_id: 6252001
description:
2026-02-03 01:21:32 dovecot_login authenticator failed for H=(localhost) [130.12.182.49]:52192: 535 Incorrect authentication data (set_id=root)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-03 01:21:20 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:60714: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 146.70.146.50
country_id: 2782113
description:
Feb  3 01:21:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent@a-connect.global has been locked for the attacker IP 146.70.146.50


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.210.42
country_id: 2750405
description:
Feb  3 01:21:32 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.210.42


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 01:21:05 dovecot_login authenticator failed for H=(4BydnZ1W) [158.94.210.42]:57156: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-03 01:21:20 dovecot_login authenticator failed for H=(Q7lmHu) [146.70.146.50]:58716: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.200.210.122
country_id: 1835841
domain: pspoly.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/pspolycom/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.200.210.122
country_id: 1835841
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/m.php||SC:/home2/pspolycom/public_html/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/img/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:21:13 dovecot_login authenticator failed for H=(Rfel8GT) [178.16.52.139]:64603: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:21:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50216: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:22:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64693: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 01:22:35 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.210.42
country_id: 2750405
description:
Feb  3 01:22:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.210.42


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/dovecot/ssl/dovecot.key||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 01:22:05 dovecot_login authenticator failed for H=(VTJyuJ7) [158.94.210.42]:62855: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 01:22:08 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46978: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:22:10 dovecot_login authenticator failed for H=(H9X2Aj5W) [178.16.52.139]:54671: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 01:23:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:23:04 dovecot_login authenticator failed for H=(Nv1HKOAjE) [178.16.52.139]:54701: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 01:23:04 dovecot_login authenticator failed for H=(ggZpEyYw6) [158.94.210.42]:53357: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.99.61.248
country_id: 1269750
description:
2026-02-03 01:23:46 dovecot_login authenticator failed for H=([14.99.61.248]) [14.99.61.248]:55452: 535 Incorrect authentication data (set_id=office@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.41.122
country_id: 1269750
description:
2026-02-03 01:23:57 dovecot_login authenticator failed for H=([125.23.243.66]) [125.23.41.122]:42234: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.210.42
country_id: 2750405
description:
Feb  3 01:23:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.210.42


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 01:23:07 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 01:23:17 H=(185.93.89.63) [185.93.89.63]:58604 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <barnesm@ssd.loral.com>: The mail server could not deliver mail to barnesm@ssd.loral.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:23:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51243: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:24:25 dovecot_login authenticator failed for H=(WJdUMgD6K) [178.16.52.139]:62472: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 01:24:27 H=(185.93.89.63) [185.93.89.63]:58934 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <joe.geanetta@ppar.com>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:24:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64621: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.210.42
country_id: 2750405
description:
Feb  3 01:24:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.210.42


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 01:24:05 dovecot_login authenticator failed for H=(TVXEDPu) [158.94.210.42]:61908: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-03  1:24:10 331837 [Warning] Aborted connection 331837 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 01:24:22 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49466: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 01:24:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/xml/xml.xsd||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/dbus-1/system.d/org.freedesktop.NetworkManager.conf||User:root||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 01:25:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:25:23 dovecot_login authenticator failed for H=(OZEhjav0L) [178.16.52.139]:64847: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.210.42
country_id: 2750405
description:
Feb  3 01:25:30 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.210.42


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 01:25:32 dovecot_login authenticator failed for H=(baAhwF4) [158.94.210.42]:59513: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 01:25:37 H=(185.93.89.63) [185.93.89.63]:59172 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <gregory_hagler@doh.state.fl.us>: The mail server could not deliver mail to gregory_hagler@doh.state.fl.us.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 01:25:57 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:25:24 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60233: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 34.34.132.221
country_id: 2802361
description:
Feb  3 01:25:53 sv3 pure-ftpd[2424131]: (?@34.34.132.221) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:26:24 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55575: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2026-02-03 01:26:47 dovecot_plain authenticator failed for H=c-73-197-236-163.hsd1.nj.comcast.net (nontang) [73.197.236.163]:39846: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.2
country_id: 1269750
description:
2026-02-03 01:26:27 dovecot_login authenticator failed for H=(nsg-corporate-2.187.185.122.airtel.in) [122.185.187.2]:38800: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2026-02-03 01:26:35 dovecot_login authenticator failed for H=(nsg-static-145.58.71.182.airtel.in) [27.123.102.50]:54036: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2026-02-03 01:26:51 dovecot_plain authenticator failed for H=c-68-52-119-193.hsd1.tn.comcast.net (ammengs) [68.52.119.193]:36882: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 01:26:06 dovecot_login authenticator failed for H=(ZcitBzO) [158.94.210.42]:50607: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 01:26:33 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 01:26:46 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:37664: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.63.175
country_id: 1814991
description:
2026-02-03 01:26:58 dovecot_login authenticator failed for H=([182.135.63.175]) [182.135.63.175]:44801: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 01:26:52 H=(185.93.89.63) [185.93.89.63]:59344 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<admin@ketcauthep.com> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <pswartz@denver.k12.co.us>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2026-02-03 01:26:14 dovecot_login authenticator failed for H=syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:54906: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/cwd/etc/security/limits.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.144
country_id: 1269750
description:
2026-02-03 01:26:23 dovecot_login authenticator failed for H=(nsg-corporate-144.227.187.122.airtel.in) [122.187.227.144]:53186: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:26:35 dovecot_login authenticator failed for H=(zsH29ORePR) [178.16.52.139]:59543: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-02-03 01:26:42 dovecot_login authenticator failed for H=([196.189.59.226]) [196.189.59.226]:43728: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/dbus-1/system.d/org.freedesktop.hostname1.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:27:05 dovecot_login authenticator failed for H=(VfHg3w) [178.16.52.139]:57086: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:27:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65104: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 01:27:10 H=(185.93.89.63) [185.93.89.63]:59410 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <eharrell@uhseast.com>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.115.33.3
country_id: 3865483
description:
2026-02-03 01:27:44 dovecot_login authenticator failed for H=(HY-98547) [190.115.33.3]:38659: 535 Incorrect authentication data (set_id=kimmarkpurchase@kimmark.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 01:27:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 01:28:13 dovecot_login authenticator failed for H=(WQJUogl) [158.94.210.42]:64615: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 01:28:30 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/cwd/etc/agent360.ini||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:28:16 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59115: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:28:29 dovecot_login authenticator failed for H=(jHAyVax) [178.16.52.139]:54057: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-03  1:28:43 332157 [Warning] Aborted connection 332157 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 01:29:10 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:60336: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 34.34.132.221
country_id: 2802361
description:
Feb  3 01:29:59 sv3 pure-ftpd[2427277]: (?@34.34.132.221) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:29:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58331: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/cwd/etc/ossec-init.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:29:30 dovecot_login authenticator failed for H=(Q9CuCE) [178.16.52.139]:52560: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 34.76.70.200
country_id: 2802361
description:
Feb  3 01:29:42 sv3 pure-ftpd[2426992]: (?@34.76.70.200) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 01:29:57 H=(185.93.89.63) [185.93.89.63]:60069 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <ekrishnek@mrici.com>: The mail server could not deliver mail to ekrishnek@mrici.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 01:29:22 dovecot_login authenticator failed for H=(AQtLQ0ao) [158.94.210.42]:53757: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/alsa/pcm/surround50.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:30:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52302: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.6.250.243
country_id: 6252001
description:
2026-02-03 01:30:11 dovecot_login authenticator failed for H=(50-6-250-243.unifiedlayer.com) [50.6.250.243]:46108: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2026-02-03 01:30:21 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se [155.4.31.215]:57676: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 01:30:16 dovecot_login authenticator failed for H=(5HJdGzWB) [158.94.210.42]:62333: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 01:31:23 dovecot_login authenticator failed for H=(TCFxDiv) [158.94.210.42]:57593: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 01:31:37 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 01:31:52 H=(185.93.89.63) [185.93.89.63]:60361 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <georgia.hansberg@pmaptclean.com>: The mail server could not deliver mail to georgia.hansberg@pmaptclean.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:31:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56568: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 01:31:34 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41764: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:31:07 dovecot_login authenticator failed for H=(AZ3x1bW) [178.16.52.139]:57490: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/cwd/etc/openldap/ldap.conf||User:root||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 01:32:59 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/alsa/pcm/dsnoop.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 01:32:41 dovecot_login authenticator failed for H=(4o4XlOIM) [158.94.210.42]:58279: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 01:32:40 H=(185.93.89.63) [185.93.89.63]:60487 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <smiller@mc.cc.md.us>: host lookup did not complete


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.176.17.66
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php?page_id=39 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 01:32:50 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:32:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52058: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:32:28 dovecot_login authenticator failed for H=(hkXyEb) [178.16.52.139]:49234: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 01:33:44 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44346: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/alsa/pcm/surround51.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:33:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62253: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 01:33:30 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:33:32 dovecot_login authenticator failed for H=(aDDEy82) [178.16.52.139]:49818: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 01:34:17 dovecot_login authenticator failed for H=(VxrRmk) [158.94.210.42]:58676: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/fontconfig/conf.avail/70-yes-bitmaps.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:34:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56371: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13010
name: Delayed Multiple triggers of Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 01:34:13 H=(185.93.89.63) [185.93.89.63]:60832 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <tami.bremer@ppar.com>: host lookup did not complete


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 01:34:51 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:34:53 dovecot_login authenticator failed for H=(zhxCXj) [178.16.52.139]:61766: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 01:35:01 H=(185.93.89.63) [185.93.89.63]:61042 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <cory@www.rodp.ridne.net>: The mail server could not deliver mail to cory@www.rodp.ridne.net.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.116
country_id: 6252001
description:
2026-02-03  1:34:15 333335 [Warning] Aborted connection 333335 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.116' (This connection closed normally without authentication)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 01:34:41 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/fontconfig/conf.avail/69-unifont.conf||User:root||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 01:35:46 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:35:48 dovecot_login authenticator failed for H=(XMfljGHf) [178.16.52.139]:51921: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:35:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50482: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 01:36:09 H=(185.93.89.63) [185.93.89.63]:61238 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <wlehr@cbnk.com>: The mail server could not deliver mail to wlehr@cbnk.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.170.117
country_id: 3175395
description:
2026-02-03 01:36:10 dovecot_plain authenticator failed for H=([100.64.100.6]) [2.57.170.117]:57909: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:36:37 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54485: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 01:36:03 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 01:36:02 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46206: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 01:36:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:36:15 dovecot_login authenticator failed for H=(2cUnJa) [178.16.52.139]:54827: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/fontconfig/conf.avail/65-google-droid-sans-fonts.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 01:36:32 dovecot_login authenticator failed for H=(i4JXvu) [158.94.210.42]:63010: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:37:03 dovecot_login authenticator failed for H=(PCdtY8jBI) [178.16.52.139]:58001: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 01:37:36 dovecot_login authenticator failed for H=(oLw8Of) [158.94.210.42]:64835: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 01:37:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/sw-engine/pool.d/sw-engine-fpm.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:37:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52458: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/img/demos/img/new-development.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 01:37:44 H=(185.93.89.63) [185.93.89.63]:61456 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <elewis@tamerica.com>: The mail server could not deliver mail to elewis@tamerica.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 01:38:07 H=(185.93.89.63) [185.93.89.63]:61505 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <mahanle@collier.k12.fl.us>: The mail server could not deliver mail to mahanle@collier.k12.fl.us.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 01:38:07 dovecot_login authenticator failed for H=(r2CUwai) [158.94.210.42]:53966: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2026-02-03 01:38:18 dovecot_login authenticator failed for H=107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:63163: 535 Incorrect authentication data (set_id=contacto@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:38:24 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64170: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/fontconfig/conf.avail/61-urw-p052.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 01:38:18 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47094: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:38:22 dovecot_login authenticator failed for H=(6R8ZTYP) [178.16.52.139]:50013: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 01:39:31 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:39:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58089: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.182.166
country_id: 1269750
description:
2026-02-03 01:39:27 dovecot_login authenticator failed for H=([182.95.182.166]) [182.95.182.166]:37044: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.169
country_id: 2635167
description:
2026-02-03  1:39:48 333751 [Warning] Aborted connection 333751 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.169' (This connection closed normally without authentication)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/home5/manfotp3/etc/manforce.net/manforce.admin.rcube.db||User:manfotp3||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.104.172.143
country_id: 3895114
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/training-details.php?id=618918 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:39:42 dovecot_login authenticator failed for H=(y0oqmg6) [178.16.52.139]:64327: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 01:39:42 H=(185.93.89.63) [185.93.89.63]:61915 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <jmmcclenahan@apacmail.com>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.161.110.210
country_id: 2017370
description:
2026-02-03 01:40:48 dovecot_login authenticator failed for H=109-161-110-210.pppoe.yaroslavl.ru ([127.0.0.1]) [109.161.110.210]:50631: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2026-02-03 01:40:03 dovecot_login authenticator failed for H=([64.53.7.231]) [64.53.7.231]:37406: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:40:18 dovecot_login authenticator failed for H=(XM11QevhD) [178.16.52.139]:62979: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/cwd/etc/sestatus.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.249
country_id: 1733045
description:
2026-02-03 01:40:20 dovecot_login authenticator failed for H=([49.124.152.249]) [49.124.152.249]:53184: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 01:40:28 H=(185.93.89.63) [185.93.89.63]:62118 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <ecorrea@sausd.k12.ca.us>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 01:40:30 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46106: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.111.37.191
country_id: 6252001
description:
2026-02-03 01:40:42 dovecot_login authenticator failed for H=wsip-68-111-37-191.sb.sd.cox.net ([127.0.0.1]) [68.111.37.191]:57808: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:40:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51696: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-03 01:40:20 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:56920: 535 Incorrect authentication data (set_id=cass@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-03 01:41:30 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:65387: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 01:41:35 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/home5/manfotp3/etc/manforce.net/financeintern.rcube.db||User:manfotp3||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 01:41:15 H=(185.93.89.63) [185.93.89.63]:62231 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <sgindy@sensordata.com>: The mail server could not deliver mail to sgindy@sensordata.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:41:16 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61394: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:41:16 dovecot_login authenticator failed for H=(2pi1w42H) [178.16.52.139]:61249: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/home5/manfotp3/etc/manforce.net/yon.seechi.rcube.db||User:manfotp3||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 01:42:06 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 01:42:07 H=(185.93.89.63) [185.93.89.63]:62337 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <jennifer.mildonian@ccs.k12.va.us>: The mail server could not deliver mail to jennifer.mildonian@ccs.k12.va.us.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 01:42:40 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36776: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:42:16 dovecot_login authenticator failed for H=(4uKIZKmWxk) [178.16.52.139]:54963: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:42:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54798: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 01:43:18 H=(185.93.89.63) [185.93.89.63]:62518 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <skontos@qwsco.com>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:43:41 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56686: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/home4/manfotp3/etc/manforce.net/cheryl.ng.rcube.db||User:manfotp3||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:43:10 dovecot_login authenticator failed for H=(oJxiN3PX2) [178.16.52.139]:55401: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.190
country_id: 1269750
description:
2026-02-03 01:43:23 dovecot_login authenticator failed for H=([128.185.194.190]) [128.185.194.190]:47382: 535 Incorrect authentication data (set_id=test@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.123.109.43
country_id: 732800
description:
2026-02-03 01:43:28 dovecot_login authenticator failed for H=(ADMIN) [93.123.109.43]:47914: 535 Incorrect authentication data (set_id=corporate@krisfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2026-02-03 01:43:31 dovecot_login authenticator failed for H=([182.95.226.118]) [182.95.226.118]:38172: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 01:43:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.143.54.23
country_id: 2542007
description:
2026-02-03 01:43:18 dovecot_login authenticator failed for H=(NpGSu21z) [41.143.54.23]:9858: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 01:44:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:44:44 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52303: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/home4/manfotp3/etc/manforce.net/cheewai.low.rcube.db||User:manfotp3||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 01:44:46 H=(185.93.89.63) [185.93.89.63]:62870 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <steve.swan@us.ing.com>: The mail server could not deliver mail to steve.swan@us.ing.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 01:44:44 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 01:44:50 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:58372: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:44:21 dovecot_login authenticator failed for H=(zIDHjfm1) [178.16.52.139]:56108: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 64.89.161.113
country_id: 2635167
description:
Feb  3 01:44:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account euratech@euratech.com.my has been temporarily locked by Imunify PAM(64.89.161.113)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/home4/manfotp3/etc/manforce.net/joshua.lee.rcube.db||User:manfotp3||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 180.195.41.160
country_id: 1694008
domain: visoft.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:22497.visoft.com.my||ServerName:visoft.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:58a6e2fae6aed3f5af35679673283a1b30819553||Title:0x4134ddb4||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 01:45:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:45:37 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62668: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-03 01:45:56 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:60827: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:45:19 dovecot_login authenticator failed for H=(1GzL4hXFu) [178.16.52.139]:54096: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 64.89.161.113
country_id: 2635167
description:
Feb  3 01:45:58 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account euratech@euratech.com.my has been temporarily locked by Imunify PAM(64.89.161.113)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 01:47:00 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52906: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 01:46:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:46:14 dovecot_login authenticator failed for H=(h0BBr6Uxa) [178.16.52.139]:49908: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 64.89.161.113
country_id: 2635167
description:
Feb  3 01:46:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account euratech@euratech.com.my has been temporarily locked by Imunify PAM(64.89.161.113)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/home4/manfotp3/etc/manforce.net/chunyuen.lok.rcube.db||User:manfotp3||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:46:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56160: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.64.21.147
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=78301515046722 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:46:18 dovecot_login authenticator failed for H=(q9Q60Vv) [178.16.52.139]:58152: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:47:19 dovecot_login authenticator failed for H=(WxFlbc) [178.16.52.139]:56766: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:47:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49686: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.111.37.154
country_id: 6252001
description:
2026-02-03 01:47:51 dovecot_login authenticator failed for H=wsip-68-111-37-154.sb.sd.cox.net ([127.0.0.1]) [68.111.37.154]:44558: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.169
country_id: 2635167
description:
2026-02-03  1:47:18 334143 [Warning] Aborted connection 334143 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.169' (This connection closed normally without authentication)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/home5/manfotp3/etc/manforce.net/alia.farhana.rcube.db||User:manfotp3||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 01:47:11 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 01:47:36 H=(185.93.89.63) [185.93.89.63]:63374 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <lockhaca@collier.k12.fl.us>: The mail server could not deliver mail to lockhaca@collier.k12.fl.us.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.170
country_id: 1149361
description:
2026-02-03 01:47:59 dovecot_login authenticator failed for H=([127.0.0.1]) [149.54.62.170]:51594: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/home5/manfotp3/etc/manforce.net/liyana.mohamadrashid.rcube.db||User:manfotp3||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:48:10 dovecot_login authenticator failed for H=(5YIRl5Z) [178.16.52.139]:56606: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 01:48:43 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.184.138.240
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=74881514511818 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:48:15 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63210: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.253.161.61
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=27461515744985 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:49:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57957: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:49:37 dovecot_login authenticator failed for H=(YrrhIN8a) [178.16.52.139]:51019: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:49:08 dovecot_login authenticator failed for H=(3HMIlytU) [178.16.52.139]:51653: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 01:49:08 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50612: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/home3.ori/manfotp3/etc/saniclean.net/ibrahim.rcube.db||User:manfotp3||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 01:49:04 H=(185.93.89.63) [185.93.89.63]:63637 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <tglow@ci.omaha.ne.us>: The mail server could not deliver mail to tglow@ci.omaha.ne.us.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.169
country_id: 2635167
description:
2026-02-03  1:50:26 334241 [Warning] Aborted connection 334241 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.169' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:50:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51215: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.140.37
country_id: 290557
description:
2026-02-03 01:50:43 dovecot_plain authenticator failed for H=(42.0.28.25) [181.214.140.37]:36086: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/team.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 01:50:55 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:50:14 dovecot_login authenticator failed for H=(Qh6HFUFQ) [178.16.52.139]:55364: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.13.99.66
country_id: 1814991
description:
2026-02-03 01:51:25 dovecot_login authenticator failed for H=([210.13.99.68]) [210.13.99.66]:2084: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 01:51:17 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:45218: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.70.157.25
country_id: 6252001
description:
2026-02-03 01:51:21 dovecot_login authenticator failed for H=([152.70.157.25]) [152.70.157.25]:46688: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.12
country_id: 1269750
description:
2026-02-03 01:51:30 dovecot_login authenticator failed for H=(nsg-corporate-12.226.187.122.airtel.in) [122.187.226.12]:50092: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.141.241.229
country_id: 6252001
description:
2026-02-03 01:51:46 dovecot_login authenticator failed for H=([166.141.241.229]) [166.141.241.229]:57546: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 01:51:12 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:51:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61040: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 01:51:04 H=(185.93.89.63) [185.93.89.63]:64212 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <tbirch@osagemanhattan.com>: The mail server could not deliver mail to tbirch@osagemanhattan.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:51:32 dovecot_login authenticator failed for H=(KDgUvm) [178.16.52.139]:54268: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.129.147.102
country_id: 2017370
description:
2026-02-03 01:51:41 dovecot_plain authenticator failed for H=(webmail.mckd.com.my) [31.129.147.102]:60778: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.36.115.152
country_id: 1269750
description:
2026-02-03 01:52:07 dovecot_login authenticator failed for H=([103.68.19.170]) [49.36.115.152]:48482: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:52:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53970: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:52:17 dovecot_login authenticator failed for H=(FTreC9aR) [178.16.52.139]:65006: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 01:52:37 H=(185.93.89.63) [185.93.89.63]:64403 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <harvey@rapidtransfer.com>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:53:16 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56150: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:53:31 dovecot_login authenticator failed for H=(MGkJp6uzsI) [178.16.52.139]:55273: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.239.182
country_id: 1269750
description:
2026-02-03 01:53:38 dovecot_login authenticator failed for H=([128.185.217.84]) [128.185.239.182]:36452: 535 Incorrect authentication data (set_id=postmaster@wohcheong.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:54:00 dovecot_login authenticator failed for H=(SV9wao) [178.16.52.139]:61687: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 01:53:26 H=(185.93.89.63) [185.93.89.63]:64534 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <jdunn@dunnblue.com>: The mail server could not deliver mail to jdunn@dunnblue.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 01:53:25 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:34090: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.204.87.74
country_id: 272103
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/dream/10/284/1008391 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 47.82.11.68
country_id: 1880251
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/imunify360/cln-pub.key||User:root||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 01:53:34 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2026-02-03 01:53:47 dovecot_login authenticator failed for H=([125.16.32.137]) [125.20.228.146]:36822: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:54:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49549: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:54:10 dovecot_login authenticator failed for H=(1wozQ9H) [178.16.52.139]:56699: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/demos/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 01:54:17 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13010
name: Delayed Multiple triggers of Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 01:54:34 H=(185.93.89.63) [185.93.89.63]:64824 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <trose@qwsco.com>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:55:03 dovecot_login authenticator failed for H=(Z05IrjjylU) [178.16.52.139]:50438: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.8
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/security/pwhistory.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 01:55:35 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46354: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:55:43 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53357: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 01:55:48 H=(185.93.89.63) [185.93.89.63]:65128 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <cathyo@osceolamedicalcenter.com>: host lookup did not complete


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.90.167.126
country_id: 3469034
domain: vmsmotorsports.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:60239.vmsmotorsports.com.my||ServerName:vmsmotorsports.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2cb2015356ca1e537d05919e97b4c0c48b456e7a||Title:0x1778ce6a||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 01:56:37 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 01:56:40 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
country_id: 2017370
description:
2026-02-03 01:56:06 dovecot_plain authenticator failed for H=(axism) [95.79.108.51]:59440: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.150
country_id: 1269750
description:
2026-02-03 01:56:17 dovecot_login authenticator failed for H=(nsg-corporate-193.168.185.122.airtel.in) [125.19.163.150]:57874: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:56:36 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63426: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.7.200.152
country_id: 1861060
description:
2026-02-03 01:56:08 dovecot_login authenticator failed for H=v157-7-200-152.cwit.static.cnode.io [157.7.200.152]:58840: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:56:10 dovecot_login authenticator failed for H=(jF8SsPgfC) [178.16.52.139]:61224: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 41.90.172.232
country_id: 192950
domain: vtgroupsb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:10869.vtgroupsb.com||ServerName:vtgroupsb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:95f63c91675f7fa67cff7d8b10676c31027b817e||Title:0x2440febf||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 01:57:09 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 01:57:45 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53948: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 01:57:19 H=(185.93.89.63) [185.93.89.63]:65359 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <tbirnbaum@greenbay.k12.wi.us>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:57:20 dovecot_login authenticator failed for H=(3mP146HEjK) [178.16.52.139]:56474: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:57:32 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57257: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 01:57:54 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:58:12 dovecot_login authenticator failed for H=(OqrQDQC6Lm) [178.16.52.139]:60939: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:58:27 dovecot_login authenticator failed for H=(7cPz2Fxm) [178.16.52.139]:63092: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:58:32 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49966: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.118.76.243
country_id: 6252001
description:
[2026-02-03 01:58:43 +0800] info [whostmgrd] 159.118.76.243 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 01:58:51 H=(185.93.89.63) [185.93.89.63]:49218 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <robinson@ulibnet.mtsu.edu>: The mail server could not deliver mail to robinson@ulibnet.mtsu.edu.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 01:59:13 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 01:59:18 H=(185.93.89.63) [185.93.89.63]:49302 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <rdecker@pacificdistribution.com>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 01:59:44 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61088: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 01:59:46 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 01:59:54 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50402: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 01:59:03 dovecot_login authenticator failed for H=(FIYy7AU) [178.16.52.139]:62522: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:00:41 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56606: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 02:00:45 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.150.228.211
country_id: 2510769
description:
2026-02-03 02:00:50 dovecot_login authenticator failed for H=211.red-79-150-228.dynamicip.rima-tde.net [79.150.228.211]:57956: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:00:15 dovecot_login authenticator failed for H=(zVkGIs) [178.16.52.139]:60053: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cert.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
country_id: 1814991
description:
2026-02-03 02:01:18 dovecot_login authenticator failed for H=([39.165.183.70]) [39.165.183.70]:55014: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/images/cert.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:01:41 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50325: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.174.191
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=99031515979810 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.8.195.195
country_id: 1814991
description:
2026-02-03 02:02:01 dovecot_login authenticator failed for H=([27.8.195.195]) [27.8.195.195]:4971: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:01:20 dovecot_login authenticator failed for H=(KLM2Y25CG) [178.16.52.139]:59609: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.20
country_id: 2750405
description:
Feb  3 02:02:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account mustapa@astlog.com.my has been temporarily locked by Imunify PAM(46.151.182.20)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.6.250.243
country_id: 6252001
description:
2026-02-03 02:02:35 dovecot_login authenticator failed for H=(50-6-250-243.unifiedlayer.com) [50.6.250.243]:44782: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-03 02:02:47 +0800] info [cpaneld] 185.204.54.153 - symphony "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user symphony (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.79.112
country_id: 1814991
description:
2026-02-03 02:02:13 dovecot_login authenticator failed for H=([111.26.79.111]) [111.26.79.112]:52090: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.5.109.4
country_id: 2017370
description:
2026-02-03 02:02:14 dovecot_plain authenticator failed for H=(fulate) [213.5.109.4]:57188: 535 Incorrect authentication data (set_id=huichieng@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.64.13.167
country_id: 2017370
description:
2026-02-03 02:02:31 dovecot_login authenticator failed for H=([178.64.13.167]) [178.64.13.167]:57979: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:02:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59083: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:02:54 dovecot_login authenticator failed for H=(qkJvWf) [178.16.52.139]:58792: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:02:02 dovecot_login authenticator failed for H=(xPsi9cB) [178.16.52.139]:51670: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 02:02:05 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41284: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:03:19 dovecot_login authenticator failed for H=(q7w85aAbjx) [178.16.52.139]:65077: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:03:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51627: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.14
country_id: 2750405
description:
Feb  3 02:03:58 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account mustapa@astlog.com.my has been temporarily locked by Imunify PAM(46.151.182.14)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 02:04:00 H=(185.93.89.63) [185.93.89.63]:50195 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <tomv@jameswalkermfg.com>: The mail server could not deliver mail to tomv@jameswalkermfg.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 02:03:12 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:04:10 dovecot_login authenticator failed for H=(Ao8WaEa) [178.16.52.139]:53088: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.237.165.29
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=49061514886317 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 02:04:14 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43504: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 02:04:38 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:04:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61604: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.22
country_id: 2750405
description:
Feb  3 02:04:42 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account mustapa@astlog.com.my has been temporarily locked by Imunify PAM(46.151.182.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:05:03 dovecot_login authenticator failed for H=(JO51lXu70Q) [178.16.52.139]:55565: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 02:05:11 H=(185.93.89.63) [185.93.89.63]:50507 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <mccallb@sleepingbearrealty.com>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:05:32 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54991: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 02:05:34 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 02:05:43 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info@mkmetal.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 02:06:26 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info@mkmetal.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2026-02-03 02:06:32 dovecot_plain authenticator failed for H=c-67-172-54-29.hsd1.pa.comcast.net (laphils) [67.172.54.29]:35586: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 02:06:42 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 02:06:22 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38572: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2026-02-03 02:06:28 dovecot_plain authenticator failed for H=c-73-213-237-28.hsd1.va.comcast.net (unfratels) [73.213.237.28]:50194: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:06:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49570: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 02:06:16 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:06:14 dovecot_login authenticator failed for H=(zw1v6P) [178.16.52.139]:53644: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 02:06:46 H=(185.93.89.63) [185.93.89.63]:50837 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <claya@clayamundson.com>: The mail server could not deliver mail to claya@clayamundson.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:06:58 dovecot_login authenticator failed for H=(UsQPWT) [178.16.52.139]:52120: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:07:07 dovecot_login authenticator failed for H=(9znfjVp) [178.16.52.139]:52344: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 02:07:13 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 02:07:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info@mkmetal.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:07:47 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60879: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.190.200.171
country_id: 1562822
domain: www.usfood.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.usfood.com.my/product-details.php?id=370847 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.241.225
country_id: 6252001
description:
2026-02-03 02:07:29 dovecot_login authenticator failed for H=(syn-071-012-241-225.res.spectrum.com) [71.12.241.225]:60760: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.212
country_id: 1819730
description:
2026-02-03 02:07:51 dovecot_login authenticator failed for H=212.42.246.220.static.netvigator.com [220.246.42.212]:51680: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 02:07:54 H=(185.93.89.63) [185.93.89.63]:50980 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <jtricker@lumberpeople.com>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-03 02:08:04 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:58071: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 02:08:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info@mkmetal.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 02:08:36 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 02:08:03 dovecot_login authenticator failed for H=(ZyjVcgT6) [185.36.81.54]:52997: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:08:16 dovecot_login authenticator failed for H=(DKE2xJm) [178.16.52.139]:65176: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 02:08:31 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59662: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 98.80.4.68
country_id: 6252001
description:
Feb  3 02:08:46 sv3 pure-ftpd[2455204]: (?@98.80.4.68) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 02:09:53 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 02:09:54 dovecot_login authenticator failed for H=(mnMa6N0dA) [185.36.81.54]:58106: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:09:04 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49341: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 02:09:08 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:09:16 dovecot_login authenticator failed for H=(3lJomRP) [178.16.52.139]:62674: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 02:09:29 H=(185.93.89.63) [185.93.89.63]:51264 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <mwalters@crsd.k12.pa.us>: The mail server could not deliver mail to mwalters@crsd.k12.pa.us.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77674285
name: IM360 WAF: Shell upload attempt
abuser: 69.167.32.49
country_id: 6252001
domain: astlog.com.my
description:
IM360 WAF: Shell upload attempt||MVN:ARGS:form_fields[message]||MV:\r\n\r\nIt is astonishing.\r\n\r\nWho are the Jews\r\n\r\nhttps://www.youtube.com/shorts/SEB3w3A98rU\r\n\r\nMay the eyes of starving children haunt us all\r\n\r\nhttps://www.jewishvoiceforlabour.org.uk/article/may-the-eyes-of-starving-children-haunt-us-all/\r\n\r\nhttps://www.tiktok.com/@charitymealsuk/video/7534294624647580950?is_from_webapp=1&sender_device=pc&web_id=7537073515586897430\r\n\r\nhttps://www.dci-palestine.org/starving_a_generation_report_indicts_israel_for_weaponizing_starvation_as_a_tool_of_genocide\r\n\r\nhttps://www.tiktok.com/@1948nakba.p4/video/7536871676156398870?is_from_webapp=1&sender_device=pc&web_id=7537073515586897430\r\n\r\nit is our money\r\n\r\nhttps://www.youtube.com/shorts/wiu9N1H0Huc\r\n\r\nThe most devastating genocide in the world is being carried out by the follwoing :\r\n\r\n1- AIPAC, brows ( https://www.youtube.com/watch?v=COx-t-Mk6UA ). \r\n2- Miriam Adelson brows https://www.youtube.com/watch?v=Nr0LkA7VW7Q.\r\n3- Elon Musk. \r\n3- Timothy mellonand brows https://www.youtube.com/shorts/1XJ893-kAh0  \r\n4-The Evangelical Church, \r\n\r\nWhich kill innocent women and children in Gaza.\r\n\r\nAIPAC ( https://www.youtube.com/watch?v=COx-t-Mk6UA ) and the Evangelical Church are perpetrating one of the most catastrophic genocides in history, targeting innocent women and children in Gaza.\r\n\r\nThese organizations have supplied Israel with explosives to facilitate their acts of genocide.\r\n\r\nGaza has been designated a disaster zone, severely lacking in essential resources for survival.\r\n\r\nAIPAC, The Evangelical Church, Miriam Adelson, Elon Musk, and timothy mellon and   America tax payer,, and Israel have devastated 90% of Gaza, resulting in the destruction of 437,600 homes and the loss of one million lives, including 50,000 individuals currently trapped under debris, with 80% of the casualties being women and children.\r\n\r\nThey have also obliterated 330,000 meters of water pipelines, leaving the population without access to drinking water.\r\n\r\nFurthermore, over 655,000 meters of underground sewage systems have been destroyed, depriving residents of basic sanitation facilities.\r\n\r\nThe destruction extends to 2,800,000 meters of roadways, rendering transportation impossible for the affected population.\r\n\r\nAdditionally, 3,680 kilometers of the electrical grid have been dismantled, leading to widespread power outages.\r\n\r\nThe assault has resulted in the demolition of 48 hospitals, eliminating critical healthcare facilities for those in need.\r\n\r\nMoreover, the actions of AIPAC, The Evangelical Church, Miriam Adelson, Elon Musk, and timothy mellon and   America tax payer,, and Israel have disrupted the education of over 785,000 students, with 494 schools and universities being completely destroyed, many due to aerial bombardments.\r\n\r\nThey have also targeted 981 mosques, effectively silencing the prayers of the homeless seeking divine assistance.\r\n\r\nAs a result of these actions, more than 39,000 young children have been left orphaned, without parents or guardians to care for them.\r\n\r\nI must emphasize that the historical context of warfare has never witnessed a scenario where 80% of a nation has been devastated, 100% of its populace has been uprooted, and 50% of the casualties are children.\r\n\r\nIt is imperative to recognize the gravity of the situation.\r\n\r\nOrganizations such as AIPAC and the Evangelical Church in America are contributing to what can only be described as genocide.\r\n\r\nhttps://www.youtube.com/shorts/IrX9v6DKH1g\r\n\r\nThe implications of American taxpayer funding in the context of Israel's actions against innocent children are alarming.\r\n\r\n1. An examination of Israel's precarious situation is warranted.\r\n\r\nhttps://www.youtube.com/watch?v=kAfIYtpcBxo\r\n\r\n2. The influence of financial power, often associated with certain groups, plays a significant role in these dynamics. Further information can be found through the provided link.\r\n\r\nhttps://mega.nz/file/FqhzGKbB#bsX4PD-O59HEA0-rynD29xkk47dmddycY5CjZfoDLYg\r\n\r\n3. Insights into the perspectives of U.S. leadership regarding AIPAC and the Evangelical Church can be explored through the following resource.\r\n\r\n https://www.tiktok.com/@thefearlessqueenmel/video/7307640994579680542?lang=en&q=why dont Americans knowl what you have seen &t=1701880206555\r\n\r\nThe tragic reality of innocent children being harmed by powerful Israeli forces utilizing American weaponry is evident in various media reports.\r\n\r\nhttps://www.youtube.com/watch?v=COx-t-Mk6UA\r\n\r\nIt is crucial to stay informed by accessing reliable news sources.\r\n\r\nhttps://www.youtube.com/watch?v=bNyUyrR0PHo\r\n\r\nLaws of jews Taur\xc3\x83\xc2\xa3t (Torah) wich is a part of the Bible\r\n \r\nWe ordained in Taur\xc3\x83\xc2\xa3t for them: \xc3\xa2\xe2\x82\xac\xc5\x93A life for a life, an eye for an eye, a nose for a nose, an ear for an ear, a tooth for a tooth and for a wound an equal retaliation.\" \r\n\r\nThe Torah, which is part of the Bible, has commanded that the same be done to the Jews. The order of the Torah, which is part of the Bible, is to immediately kill any Jew you see on the street. Since the Jews in Gaza have also killed women and children, you should kill any Jews - men, women, and children - as soon as you see them, whether on the street or anywhere else. And because they have killed everyone in Gaza without mercy, you must do the same to them. If you carry out these actions, you will be following the order of the Torah, which is part of the Bible, and you will be rewarded by going to heaven.\r\n\r\n||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 02:09:31 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info@mkmetal.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-03 02:10:41 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:60106: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 02:10:20 H=(185.93.89.63) [185.93.89.63]:51515 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <pdellise@greenbay.k12.wi.us>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:10:19 dovecot_login authenticator failed for H=(z9KbbD8Ea8) [178.16.52.139]:58098: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 02:10:40 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38488: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:10:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60695: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:11:29 dovecot_login authenticator failed for H=(6stPjGuy) [178.16.52.139]:51195: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.46.214.110
country_id: 3703430
description:
2026-02-03 02:11:57 dovecot_login authenticator failed for H=(104.214.46.200.psinetpa.net) [200.46.214.110]:60268: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.18.22
country_id: 1835841
description:
2026-02-03 02:11:37 dovecot_login authenticator failed for H=([175.205.18.22]) [175.205.18.22]:55461: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 02:11:51 H=(185.93.89.63) [185.93.89.63]:51823 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <sigrid.schmidt@appraisalresearch.com>: host lookup did not complete


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 02:11:12 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:11:16 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55772: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 02:12:43 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 02:12:49 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53546: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2026-02-03 02:12:03 dovecot_plain authenticator failed for H=c-73-13-220-220.hsd1.de.comcast.net (flouste) [73.13.220.220]:43444: 535 Incorrect authentication data (set_id=adeline@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:12:08 dovecot_login authenticator failed for H=(bug7sP6l0) [178.16.52.139]:57910: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:12:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49971: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.79.185.164
country_id: 2802361
description:
2026-02-03 02:12:39 dovecot_login authenticator failed for H=164.185.79.34.bc.googleusercontent.com (10.132.0.2) [34.79.185.164]:54764: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:12:20 dovecot_login authenticator failed for H=(SjLJ4Mu) [178.16.52.139]:49809: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 02:13:01 H=(185.93.89.63) [185.93.89.63]:52015 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <katie@cuneocom.com>: The mail server could not deliver mail to katie@cuneocom.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:13:40 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64176: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:13:03 dovecot_login authenticator failed for H=(LY7H3Hh) [178.16.52.139]:54032: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:13:04 dovecot_login authenticator failed for H=(HOgQ9VulxK) [165.154.235.118]:13072: 535 Incorrect authentication data (set_id=penny)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 02:13:05 H=(185.93.89.63) [185.93.89.63]:52021 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <janetc@roanoketrade.com>: The mail server could not deliver mail to janetc@roanoketrade.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:14:58 dovecot_login authenticator failed for H=(2Y1ELOZ4K) [178.16.52.139]:53493: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.26.99.93
country_id: 1814991
description:
2026-02-03 02:15:01 dovecot_login authenticator failed for H=([112.26.99.93]) [112.26.99.93]:51003: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:14:07 dovecot_login authenticator failed for H=(ZRsLmy8) [178.16.52.139]:56694: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:14:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56596: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 02:14:58 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35102: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 02:15:00 H=(185.93.89.63) [185.93.89.63]:52406 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <jhuang@mobilecounty.net>: The mail server could not deliver mail to jhuang@mobilecounty.net.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:14:13 dovecot_login authenticator failed for H=(L5K4TB3) [165.154.235.118]:25382: 535 Incorrect authentication data


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 02:15:42 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account cky@ahfengineering.com has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-02-03 02:15:09 dovecot_login authenticator failed for H=([193.46.192.20]) [193.46.192.20]:33963: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:15:11 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65019: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:15:19 dovecot_login authenticator failed for H=(YwVBk1FZz) [178.16.52.139]:64821: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 02:15:10 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:15:10 dovecot_login authenticator failed for H=(Cv7MFDNVX2) [165.154.235.118]:38347: 535 Incorrect authentication data


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 02:16:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account cky@ahfengineering.com has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:16:16 dovecot_login authenticator failed for H=(MN6GWH) [141.98.11.11]:59668: 535 Incorrect authentication data (set_id=chuan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-03 02:16:23 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:50029: 535 Incorrect authentication data (set_id=cass@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.57.39.170
country_id: 6252001
description:
2026-02-03 02:16:35 dovecot_login authenticator failed for H=(syn-184-057-039-170.res.spectrum.com) [184.57.39.170]:50821: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:16:06 dovecot_login authenticator failed for H=(mIXJpqf) [165.154.235.118]:51436: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:16:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59896: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:16:10 dovecot_login authenticator failed for H=(2698bz8) [178.16.52.139]:62833: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
country_id: 1835841
description:
2026-02-03 02:16:18 dovecot_login authenticator failed for H=([61.72.59.106]) [61.72.59.106]:59819: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 02:16:12 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 02:17:07 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46958: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:17:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60838: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.245.246.26
country_id: 1835841
description:
2026-02-03 02:17:13 dovecot_login authenticator failed for H=([106.245.246.26]) [106.245.246.26]:39621: 535 Incorrect authentication data (set_id=contacto@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:17:13 dovecot_login authenticator failed for H=(5n0xuf) [165.154.235.118]:2414: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.62
country_id: 1210997
description:
2026-02-03 02:17:17 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.62]:60743: 535 Incorrect authentication data (set_id=contacto@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:17:28 dovecot_login authenticator failed for H=(WGlXtP7lE) [141.98.11.11]:63677: 535 Incorrect authentication data (set_id=chuan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:17:03 dovecot_login authenticator failed for H=(yuWBGR) [178.16.52.139]:57149: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.234.37.45
country_id: 2017370
description:
2026-02-03 02:17:24 dovecot_login authenticator failed for H=([85.234.37.45]) [85.234.37.45]:50372: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.58
country_id: 1149361
description:
2026-02-03 02:17:26 dovecot_login authenticator failed for H=([149.54.62.58]) [149.54.62.58]:57731: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 02:17:28 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account cky@ahfengineering.com has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 02:17:31 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:17:36 dovecot_login authenticator failed for H=(BzbSIAh5C) [165.154.235.118]:7534: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.182.49
country_id: 6252001
description:
2026-02-03 02:18:58 dovecot_login authenticator failed for H=(localhost) [130.12.182.49]:56767: 535 Incorrect authentication data (set_id=adm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:18:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50901: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:18:10 dovecot_login authenticator failed for H=(EiJwBZgEZP) [165.154.235.118]:15031: 535 Incorrect authentication data


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 02:18:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account cky@ahfengineering.com has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:18:05 dovecot_login authenticator failed for H=(eaKTkEd) [141.98.11.11]:53809: 535 Incorrect authentication data (set_id=chuan)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 02:18:14 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:18:13 dovecot_login authenticator failed for H=(guplGtNTy) [178.16.52.139]:59281: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:19:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59367: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.220.149.121
country_id: 1835841
description:
2026-02-03 02:19:15 dovecot_login authenticator failed for H=([118.220.149.121]) [118.220.149.121]:35192: 535 Incorrect authentication data (set_id=sales@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:19:26 dovecot_login authenticator failed for H=(1fXY3Iusj) [141.98.11.11]:62480: 535 Incorrect authentication data (set_id=chuan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.53.224.95
country_id: 2077456
domain: box.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/woh/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:19:06 dovecot_login authenticator failed for H=(jB1naJ) [165.154.235.118]:27877: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 02:19:16 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:60756: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 02:19:34 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account cky@ahfengineering.com has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:19:20 dovecot_login authenticator failed for H=(MB35m9) [178.16.52.139]:51052: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2026-02-03 02:19:43 dovecot_plain authenticator failed for H=c-73-176-157-57.hsd1.il.comcast.net (somicogia) [73.176.157.57]:37980: 535 Incorrect authentication data (set_id=callen@kimmark.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/rpl.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.46.182.10
country_id: 1814991
description:
2026-02-03 02:20:47 dovecot_login authenticator failed for H=([59.46.182.10]) [59.46.182.10]:48183: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:20:01 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50776: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.9.55.43
country_id: 2635167
description:
2026-02-03 02:20:43 dovecot_login authenticator failed for H=43.55.9.51.dyn.plus.net ([127.0.0.1]) [51.9.55.43]:39964: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:20:02 dovecot_login authenticator failed for H=(ZaS8y42Vw) [178.16.52.139]:54641: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 02:20:12 H=(185.93.89.63) [185.93.89.63]:53401 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <froesch@fs.fed.us>: The mail server could not deliver mail to froesch@fs.fed.us.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:20:14 dovecot_login authenticator failed for H=(gSk30j) [165.154.235.118]:42772: 535 Incorrect authentication data


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 02:20:34 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.154.31
country_id: 1814991
description:
2026-02-03 02:20:36 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.154.31]:53972: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.188
country_id: 690791
description:
2026-02-03 02:20:47 H=([77.83.39.188]) [77.83.39.188]:3287 F=<enquiry@symphony-led.com> rejected RCPT <enquiry@symphony-led.com>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:20:02 dovecot_login authenticator failed for H=(s5WHl1pa) [165.154.235.118]:40329: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.179.158
country_id: 2017370
description:
2026-02-03 02:20:19 dovecot_login authenticator failed for H=broadband-77-37-179-158.ip.moscow.rt.ru [77.37.179.158]:58616: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:20:27 dovecot_login authenticator failed for H=(lSJlwSU) [141.98.11.11]:61496: 535 Incorrect authentication data (set_id=chuan)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 02:21:06 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:21:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60303: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:21:10 dovecot_login authenticator failed for H=(7g52tZ) [165.154.235.118]:55248: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 02:21:24 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47410: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:21:33 dovecot_login authenticator failed for H=(ZruKz8g7) [141.98.11.11]:52164: 535 Incorrect authentication data (set_id=chuan)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 02:21:58 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:21:03 dovecot_login authenticator failed for H=(hPi2eC4) [178.16.52.139]:63483: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.160.86
country_id: 6252001
description:
2026-02-03 02:22:09 dovecot_login authenticator failed for H=([127.0.0.1]) [70.174.160.86]:39401: 535 Incorrect authentication data (set_id=adilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.219.133.244
country_id: 6252001
description:
2026-02-03 02:22:17 dovecot_login authenticator failed for H=([127.0.0.1]) [71.219.133.244]:50300: 535 Incorrect authentication data (set_id=adilah)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:22:51 dovecot_login authenticator failed for H=(JNiSO5) [165.154.235.118]:13550: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:22:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53442: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:22:05 dovecot_login authenticator failed for H=(wnGA6s) [178.16.52.139]:62349: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-03 02:22:07 dovecot_login authenticator failed for H=(FAfqeQTG2) [69.5.189.21]:50497: 535 Incorrect authentication data (set_id=ratanam@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:22:06 dovecot_login authenticator failed for H=(6UOGD5) [165.154.235.118]:3469: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:22:06 dovecot_login authenticator failed for H=(lYcNQ0uK) [141.98.11.11]:60209: 535 Incorrect authentication data (set_id=chuan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:23:15 dovecot_login authenticator failed for H=(ZgEQ3maJxq) [141.98.11.11]:56425: 535 Incorrect authentication data (set_id=chuan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:23:23 dovecot_login authenticator failed for H=(4A2FFSV3Tw) [178.16.52.139]:56499: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:23:34 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56636: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 02:23:14 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2026-02-03 02:23:36 dovecot_plain authenticator failed for H=c-73-161-96-107.hsd1.mi.comcast.net (unvent) [73.161.96.107]:51840: 535 Incorrect authentication data (set_id=shutters@col.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 02:23:12 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 02:23:18 H=(185.93.89.63) [185.93.89.63]:53995 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <jkubeny@greenbay.k12.wi.us>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-03 02:23:19 dovecot_login authenticator failed for H=(2bWkIk8) [69.5.189.21]:63594: 535 Incorrect authentication data (set_id=ratanam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:23:02 dovecot_login authenticator failed for H=(FkdGTo) [165.154.235.118]:15982: 535 Incorrect authentication data


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.167
country_id: 2750405
description:
2026-02-03  2:23:34 336099 [Warning] Aborted connection 336099 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.167' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 02:23:31 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41036: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.167
country_id: 690791
description:
2026-02-03 02:24:44 H=([77.83.39.167]) [77.83.39.167]:61275 F=<stevenwelboun@op.pl> rejected RCPT <inquiries@ktlog.com.my>: SPF: 77.83.39.167 is not allowed to send mail from op.pl


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:24:10 dovecot_login authenticator failed for H=(IBC6lD49) [165.154.235.118]:31450: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:24:16 dovecot_login authenticator failed for H=(AsX7ZofxQC) [141.98.11.11]:51388: 535 Incorrect authentication data (set_id=chuan)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 02:24:44 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.167
country_id: 2750405
description:
2026-02-03  2:24:53 336227 [Warning] Aborted connection 336227 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.167' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:24:03 dovecot_login authenticator failed for H=(i4sqPH2) [178.16.52.139]:62597: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:24:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65222: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:25:06 dovecot_login authenticator failed for H=(Nr0khajTw) [165.154.235.118]:45072: 535 Incorrect authentication data


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.167
country_id: 690791
description:
2026-02-03 02:25:19 H=([77.83.39.167]) [77.83.39.167]:63835 F=<stevenwelboun@op.pl> rejected RCPT <mustapa@astlog.com.my>: SPF: 77.83.39.167 is not allowed to send mail from op.pl


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:25:25 dovecot_login authenticator failed for H=(sZ1UTJLp) [141.98.11.11]:60473: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 02:25:07 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:25:29 dovecot_login authenticator failed for H=(lV9N5j) [165.154.235.118]:50064: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:25:21 dovecot_login authenticator failed for H=(YeEAqR) [178.16.52.139]:53278: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 02:25:15 dovecot_login authenticator failed for H=(5wxyuyXx) [185.36.81.54]:60861: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:25:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58150: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 02:25:41 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41502: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 02:26:03 H=(185.93.89.63) [185.93.89.63]:54644 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <kwebb@astroinst.com>: The mail server could not deliver mail to kwebb@astroinst.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:26:03 dovecot_login authenticator failed for H=(gVLPrwEQU1) [178.16.52.139]:50151: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.145.160.134
country_id: 1269750
description:
2026-02-03 02:26:23 dovecot_login authenticator failed for H=([125.62.129.188]) [59.145.160.134]:36090: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.94.5.43
country_id: 1814991
description:
2026-02-03 02:26:08 dovecot_login authenticator failed for H=([112.94.5.43]) [112.94.5.43]:36460: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:26:34 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52182: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:26:02 dovecot_login authenticator failed for H=(PvWfbCQw) [141.98.11.11]:63663: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:26:02 dovecot_login authenticator failed for H=(DEigxo) [165.154.235.118]:57945: 535 Incorrect authentication data


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 02:27:13 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13010
name: Delayed Multiple triggers of Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 02:27:35 H=(185.93.89.63) [185.93.89.63]:54881 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <cjoyce@grandshores.com>: The mail server could not deliver mail to cjoyce@grandshores.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:27:06 dovecot_login authenticator failed for H=(XMVE0m) [178.16.52.139]:53929: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:27:31 dovecot_login authenticator failed for H=(l1cyKx4Tr) [141.98.11.11]:60841: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:27:10 dovecot_login authenticator failed for H=(ySW3YP) [165.154.235.118]:8261: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:27:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61180: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 02:27:34 H=(185.93.89.63) [185.93.89.63]:54878 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <jvite@renters-choice-inc.com>: The mail server could not deliver mail to jvite@renters-choice-inc.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 02:27:53 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47048: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.254
country_id: 6252001
description:
2026-02-03 02:27:28 dovecot_login authenticator failed for H=([209.23.72.254]) [209.23.72.254]:40178: 535 Incorrect authentication data (set_id=info@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.74.34.30
country_id: 630336
description:
2026-02-03 02:27:36 dovecot_login authenticator failed for H=([77.74.34.30]) [77.74.34.30]:56005: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:28:11 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54551: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:28:18 dovecot_login authenticator failed for H=(oobug5YPV) [165.154.235.118]:24030: 535 Incorrect authentication data


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.167
country_id: 2750405
description:
2026-02-03  2:28:21 336598 [Warning] Aborted connection 336598 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.167' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:28:23 dovecot_login authenticator failed for H=(5XIDalTAYV) [178.16.52.139]:49298: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.169.206.229
country_id: 2963597
domain: empirelog.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/empi7862/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.43.204.45
country_id: 2017370
description:
2026-02-03 02:28:36 dovecot_login authenticator failed for H=(RZD-gw.transtelecom.net) [188.43.204.45]:59793: 535 Incorrect authentication data (set_id=info@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:28:04 dovecot_login authenticator failed for H=(LfLqDT3up) [141.98.11.11]:54781: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:28:06 dovecot_login authenticator failed for H=(rTSJyCtq) [165.154.235.118]:21470: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 02:30:01 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44802: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 02:29:37 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 02:29:32 H=(185.93.89.63) [185.93.89.63]:55236 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <wrusciano@ibsfl.com>: The mail server could not deliver mail to wrusciano@ibsfl.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:29:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50379: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:29:12 dovecot_login authenticator failed for H=(y1O0ai) [178.16.52.139]:54493: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:29:03 dovecot_login authenticator failed for H=(cjQDRE8) [165.154.235.118]:34523: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:29:16 dovecot_login authenticator failed for H=(3GuHn2P5U) [141.98.11.11]:63548: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:30:42 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63094: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 02:30:04 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/root/scripts/logo.dat||User:root||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:30:44 dovecot_login authenticator failed for H=(4NEbTC7bAO) [165.154.235.118]:57226: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:30:12 dovecot_login authenticator failed for H=(u6qXqrX) [178.16.52.139]:63126: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 02:30:18 H=(185.93.89.63) [185.93.89.63]:55462 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <groot@edwardsgarmet.com>: The mail server could not deliver mail to groot@edwardsgarmet.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 02:30:20 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:30:11 dovecot_login authenticator failed for H=(nM1bxqBibU) [165.154.235.118]:49743: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.18
country_id: 1269750
description:
2026-02-03 02:30:27 dovecot_login authenticator failed for H=([182.78.64.18]) [182.78.64.18]:40516: 535 Incorrect authentication data (set_id=test@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:30:24 dovecot_login authenticator failed for H=(DM4Cps) [141.98.11.11]:54916: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:31:03 dovecot_login authenticator failed for H=(OLhMMxH) [141.98.11.11]:54314: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:31:07 dovecot_login authenticator failed for H=(QRtuqUg) [165.154.235.118]:62173: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:31:13 dovecot_login authenticator failed for H=(HwgirGgb) [178.16.52.139]:54922: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 02:31:25 H=(185.93.89.63) [185.93.89.63]:55704 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <mjones@danville.k12.pa.us>: The mail server could not deliver mail to mjones@danville.k12.pa.us.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 02:31:40 dovecot_login authenticator failed for H=(YJDqTJqCv) [185.36.81.54]:57986: 535 Incorrect authentication data (set_id=ind)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/root/lib/sysusers.d/dbus.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:31:48 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58269: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.32.80.163
country_id: 6252001
description:
[2026-02-03 02:32:22 +0800] info [whostmgrd] 76.32.80.163 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 02:32:06 dovecot_login authenticator failed for H=(jDgvbwR) [185.36.81.54]:64615: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:32:20 dovecot_login authenticator failed for H=(3Byx27xN) [141.98.11.11]:62321: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:32:03 dovecot_login authenticator failed for H=(YkDf0B4) [165.154.235.118]:12603: 535 Incorrect authentication data (set_id=penny)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:32:23 dovecot_login authenticator failed for H=(gFWGDC) [178.16.52.139]:60179: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/photos/team.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/imunify360-php-daemon/migrations/1_initialize_schema.up.sql||User:root||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 02:32:13 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 02:32:31 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51192: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 02:32:51 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:32:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58269: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:33:05 dovecot_login authenticator failed for H=(vaY2MvOxx) [178.16.52.139]:59472: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:33:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52414: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:33:31 dovecot_login authenticator failed for H=(X39Px7fFlj) [141.98.11.11]:49590: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 02:33:51 H=(185.93.89.63) [185.93.89.63]:56090 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <robert.gurtler@carle.com>: host lookup did not complete


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:33:10 dovecot_login authenticator failed for H=(jiW0xl) [165.154.235.118]:24109: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:33:22 dovecot_login authenticator failed for H=(aZDY5Pa) [165.154.235.118]:26660: 535 Incorrect authentication data


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 02:33:25 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:34:46 dovecot_login authenticator failed for H=(3PCDv2) [141.98.11.11]:54783: 535 Incorrect authentication data (set_id=chuan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:34:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60633: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 02:34:42 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:58104: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:34:06 dovecot_login authenticator failed for H=(W7CqUnA) [165.154.235.118]:37400: 535 Incorrect authentication data


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 02:34:04 H=(185.93.89.63) [185.93.89.63]:56187 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <jandab@thebookhouse.com>: The mail server could not deliver mail to jandab@thebookhouse.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:34:05 dovecot_login authenticator failed for H=(cLXZaAYRgo) [178.16.52.139]:62550: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-03 02:34:21 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:59679: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 02:34:29 dovecot_login authenticator failed for H=(Bf7NyJB) [185.36.81.54]:60223: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-03 02:35:01 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:60374: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/apache2/conf.d/php.conf||User:root||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 02:35:27 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:35:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55098: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:35:03 dovecot_login authenticator failed for H=(9sUtz53lm) [165.154.235.118]:50745: 535 Incorrect authentication data


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/demos/img/product.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:35:21 dovecot_login authenticator failed for H=(AMAP8WpP) [178.16.52.139]:53304: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 02:35:42 dovecot_login authenticator failed for H=(FEcpfrWgY) [185.36.81.54]:58778: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:35:48 dovecot_login authenticator failed for H=(XjWePvtM) [165.154.235.118]:61571: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:35:21 dovecot_login authenticator failed for H=(9A8FDbK4) [141.98.11.11]:52205: 535 Incorrect authentication data (set_id=chuan)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/root/etc/request-key.conf||User:root||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 02:35:31 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 02:35:45 H=(185.93.89.63) [185.93.89.63]:56626 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <kenvp@dunnblue.com>: The mail server could not deliver mail to kenvp@dunnblue.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:36:10 dovecot_login authenticator failed for H=(0Y66Stry) [165.154.235.118]:2242: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:36:17 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62158: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 02:36:19 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 02:36:50 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47496: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/modprobe.d/systemd.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:36:06 dovecot_login authenticator failed for H=(Uk34dyZ) [178.16.52.139]:50082: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:36:51 dovecot_login authenticator failed for H=(0hFGCD0R) [141.98.11.11]:64146: 535 Incorrect authentication data (set_id=chuan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 02:37:15 dovecot_login authenticator failed for H=(cRIEvFYXnM) [185.36.81.54]:61639: 535 Incorrect authentication data (set_id=mustapa)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/apache2/conf.d/http2.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:37:07 dovecot_login authenticator failed for H=(AWuzhdtU) [165.154.235.118]:16017: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:37:10 dovecot_login authenticator failed for H=(4I6WwM1j6M) [178.16.52.139]:65361: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:37:11 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54088: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 02:37:04 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:37:47 dovecot_login authenticator failed for H=(19mBO0va) [141.98.11.11]:64961: 535 Incorrect authentication data (set_id=chuan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 02:38:07 dovecot_login authenticator failed for H=(HQBjicuy) [185.36.81.54]:55509: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:38:25 dovecot_login authenticator failed for H=(FwcUxz) [165.154.235.118]:35470: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2026-02-03 02:38:31 dovecot_plain authenticator failed for H=c-68-40-189-43.hsd1.mi.comcast.net (aforrins) [68.40.189.43]:54140: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:38:25 dovecot_login authenticator failed for H=(WnUBDWa) [141.98.11.11]:62307: 535 Incorrect authentication data (set_id=chuan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:38:03 dovecot_login authenticator failed for H=(xElHwn) [165.154.235.118]:30088: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.16.83.159
country_id: 2017370
description:
2026-02-03 02:38:47 dovecot_login authenticator failed for H=(5x16x83x159.dynamic.spb.ertelecom.ru) [5.16.83.159]:59040: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:38:17 dovecot_login authenticator failed for H=(NqNXQw1K) [178.16.52.139]:54171: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/cache/dnf/packages.db||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:38:17 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64720: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-03  2:38:33 338189 [Warning] Aborted connection 338189 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 02:39:02 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33978: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:39:06 dovecot_login authenticator failed for H=(FhHcfkwg) [178.16.52.139]:65371: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/root/lib/sysctl.d/50-coredump.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.171.250.66
country_id: 3865483
description:
2026-02-03 02:39:15 dovecot_plain authenticator failed for H=(to4ecy4fjzqfpw7mq9o7oh42qn8441) [181.171.250.66]:64166: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:39:41 dovecot_login authenticator failed for H=(GylLacHOg) [141.98.11.11]:61302: 535 Incorrect authentication data (set_id=chuan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.171.208.245
country_id: 1835841
description:
2026-02-03 02:39:04 dovecot_login authenticator failed for H=([121.171.208.245]) [121.171.208.245]:38960: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:39:10 dovecot_login authenticator failed for H=(RXE6KGI9) [165.154.235.118]:45983: 535 Incorrect authentication data


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 02:39:14 H=(185.93.89.63) [185.93.89.63]:57196 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <mfontana@itwbuildex.com>: The mail server could not deliver mail to mfontana@itwbuildex.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 02:39:35 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:39:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53288: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/root/lib/dracut/dracut.conf.d/01-dist.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:40:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56043: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:40:07 dovecot_login authenticator failed for H=(AugTB09) [165.154.235.118]:58555: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:40:20 dovecot_login authenticator failed for H=(m8GboYx) [141.98.11.11]:60999: 535 Incorrect authentication data (set_id=chuan)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 02:40:23 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2026-02-03 02:40:40 dovecot_login authenticator failed for H=(152-237-221-1.user.vtal.net.br) [187.40.215.162]:54315: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-02-03 02:40:23 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:28838: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:40:18 dovecot_login authenticator failed for H=(UouupBjd) [178.16.52.139]:56190: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:41:09 dovecot_login authenticator failed for H=(OmEDs6Yb) [141.98.11.11]:50604: 535 Incorrect authentication data (set_id=chuan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:41:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65203: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.92.129.168
country_id: 1814991
description:
2026-02-03 02:41:46 dovecot_login authenticator failed for H=([127.0.0.1]) [211.92.129.168]:35067: 535 Incorrect authentication data (set_id=alexsantiago@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.27.90
country_id: 1814991
description:
2026-02-03 02:41:57 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.27.90]:37135: 535 Incorrect authentication data (set_id=alexsantiago)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 02:42:00 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.142.48.143
country_id: 2017370
description:
2026-02-03 02:42:00 dovecot_plain authenticator failed for H=(nonjaleded) [213.142.48.143]:57908: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-03 02:41:22 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (mitene) [87.103.126.54]:63279: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:41:25 dovecot_login authenticator failed for H=(t5xL5NT3RE) [178.16.52.139]:62171: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 02:41:45 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:41:03 dovecot_login authenticator failed for H=(l8pMDCw) [165.154.235.118]:6769: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:41:14 dovecot_login authenticator failed for H=(hvvGZB) [165.154.235.118]:9597: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-02-03 02:41:57 dovecot_login authenticator failed for H=([182.95.228.194]) [182.95.228.194]:52680: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 02:41:09 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33908: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 02:41:53 dovecot_login authenticator failed for H=(XwQjduu6Vk) [185.36.81.54]:53541: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:42:12 dovecot_login authenticator failed for H=(DdtD8cNnMn) [178.16.52.139]:53847: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:42:28 dovecot_login authenticator failed for H=(APewPVK) [141.98.11.11]:62364: 535 Incorrect authentication data (set_id=chuan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:42:10 dovecot_login authenticator failed for H=(HEtLRftgH) [165.154.235.118]:22724: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:42:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56873: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.31.59
country_id: 2017370
description:
2026-02-03 02:42:33 dovecot_login authenticator failed for H=([31.173.31.59]) [31.173.31.59]:38930: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.29.233
country_id: 3469034
description:
2026-02-03 02:42:10 dovecot_login authenticator failed for H=(gatecidos.static.gvt.net.br) [179.185.29.233]:41203: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.250.17.45
country_id: 6252001
description:
2026-02-03 02:42:12 dovecot_login authenticator failed for H=([72.250.17.45]) [72.250.17.45]:52887: 535 Incorrect authentication data (set_id=postmaster@ocned.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 02:42:44 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 02:42:23 dovecot_login authenticator failed for H=(8006Rapf) [185.36.81.54]:59779: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:43:06 dovecot_login authenticator failed for H=(ccDPnz) [141.98.11.11]:64258: 535 Incorrect authentication data (set_id=chuan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:43:07 dovecot_login authenticator failed for H=(Kp5JUAPXu) [165.154.235.118]:35910: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:43:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64084: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 02:43:16 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49218: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:43:16 dovecot_login authenticator failed for H=(KTAb15NJyc) [178.16.52.139]:61078: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 02:43:04 H=(185.93.89.63) [185.93.89.63]:57966 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <ttofanelli@renters-choice-inc.com>: The mail server could not deliver mail to ttofanelli@renters-choice-inc.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/systemd/system/imunify360-webshield.service.d/10-enable-cgroup-accounting.conf||User:root||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:43:40 dovecot_login authenticator failed for H=(9kHTu05) [165.154.235.118]:44113: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 02:43:42 dovecot_login authenticator failed for H=(DrgUpjrLmB) [185.36.81.54]:59179: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-02-03 02:43:16 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:53140: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:44:28 dovecot_login authenticator failed for H=(wEvzT0AM9Q) [141.98.11.11]:62287: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:44:36 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52847: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 02:45:01 H=(185.93.89.63) [185.93.89.63]:58306 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <schrt01@students.ipfw.edu>: The mail server could not deliver mail to schrt01@students.ipfw.edu.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.30.212.99
country_id: 298795
description:
2026-02-03 02:45:01 dovecot_login authenticator failed for H=([176.30.212.99]) [176.30.212.99]:44296: 535 Incorrect authentication data (set_id=support@wohcheong.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:44:03 dovecot_login authenticator failed for H=(2XyslaWL) [165.154.235.118]:49574: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:44:27 dovecot_login authenticator failed for H=(LoWFD3H) [178.16.52.139]:52251: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 02:45:08 dovecot_login authenticator failed for H=(r75eokOD) [185.36.81.54]:61723: 535 Incorrect authentication data (set_id=ind)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 02:45:23 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49186: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.25.236.147
country_id: 2017370
description:
2026-02-03 02:45:58 dovecot_login authenticator failed for H=([217.25.236.147]) [217.25.236.147]:53976: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 02:45:07 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:45:10 dovecot_login authenticator failed for H=(bhztqH) [165.154.235.118]:64864: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:45:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62131: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:45:11 dovecot_login authenticator failed for H=(CeS9Zyb) [178.16.52.139]:54817: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.74.41
country_id: 1527747
description:
2026-02-03 02:45:17 dovecot_login authenticator failed for H=(92-62-74-41.saimanet.kg) [92.62.74.41]:44210: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.231.82
country_id: 1269750
description:
2026-02-03 02:45:44 dovecot_login authenticator failed for H=([182.95.231.82]) [182.95.231.82]:34946: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:45:41 dovecot_login authenticator failed for H=(yyko9ammlZ) [141.98.11.11]:55770: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/images/sliders/about.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 02:46:10 dovecot_login authenticator failed for H=(1nEmnz) [185.36.81.54]:57585: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:46:17 dovecot_login authenticator failed for H=(q1gQgmi) [141.98.11.11]:59686: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:46:08 dovecot_login authenticator failed for H=(xgim8Kpt) [178.16.52.139]:52197: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:46:18 dovecot_login authenticator failed for H=(beB59pt3NG) [165.154.235.118]:15171: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.85.26.226
country_id: 6252001
description:
2026-02-03 02:46:01 dovecot_login authenticator failed for H=(7r5EO8BRc) [66.85.26.226]:57170: 535 Incorrect authentication data (set_id=din)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:46:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54975: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:46:07 dovecot_login authenticator failed for H=(5EATFIKKY) [165.154.235.118]:12766: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:47:03 dovecot_login authenticator failed for H=(V18aF1szuO) [165.154.235.118]:25224: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:47:10 dovecot_login authenticator failed for H=(oXmr6bV1SE) [178.16.52.139]:60618: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:47:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64383: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:47:19 dovecot_login authenticator failed for H=(s3sAYJ6gXs) [141.98.11.11]:64054: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/cwd/etc/apache2/conf.modules.d/035_mod_auth_basic.conf||User:root||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 02:47:35 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 02:47:37 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49826: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 02:47:47 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 02:47:48 H=(185.93.89.63) [185.93.89.63]:58901 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <charles@islandstarrealestate.com>: The mail server could not deliver mail to charles@islandstarrealestate.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 02:48:01 dovecot_login authenticator failed for H=(v7vOY3xX3v) [185.36.81.54]:62692: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:48:08 dovecot_login authenticator failed for H=(5KlnSf) [141.98.11.11]:59096: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 02:48:36 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:48:55 dovecot_login authenticator failed for H=(KKSxNLnbJD) [165.154.235.118]:51305: 535 Incorrect authentication data


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.247.137.201
country_id: 2635167
description:
Feb  3 02:48:06 sv3 pure-ftpd[2483839]: (?@185.247.137.201) [INFO] New connection from 185.247.137.201


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:48:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59347: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.62
country_id: 1210997
description:
2026-02-03 02:48:38 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.62]:46403: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/cwd/etc/libssh/libssh_client.config||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.141.61.63
country_id: 1814991
description:
2026-02-03 02:48:46 dovecot_login authenticator failed for H=([211.141.61.63]) [211.141.61.63]:40406: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 02:48:51 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:48:03 dovecot_login authenticator failed for H=(qsXWlbXpZX) [178.16.52.139]:52795: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:48:10 dovecot_login authenticator failed for H=(dGoYuh6BM) [165.154.235.118]:40850: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.13.214.18
country_id: 1814991
description:
2026-02-03 02:48:17 dovecot_login authenticator failed for H=([218.13.214.18]) [218.13.214.18]:48364: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.36.42
country_id: 1819730
description:
2026-02-03 02:48:18 dovecot_login authenticator failed for H=042.36.246.220.static.netvigator.com [220.246.36.42]:56536: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 02:48:29 dovecot_login authenticator failed for H=(P43dr24NV) [185.36.81.54]:51560: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:49:22 dovecot_login authenticator failed for H=(Rewayb7w) [141.98.11.11]:51473: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 02:49:51 dovecot_login authenticator failed for H=(RPgoJUd) [185.36.81.54]:50397: 535 Incorrect authentication data (set_id=ind)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/self/cwd/lib/tmpfiles.d/apache2.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:49:07 dovecot_login authenticator failed for H=(RcidRB) [165.154.235.118]:53890: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:49:45 dovecot_login authenticator failed for H=(ui7XKh) [178.16.52.139]:51124: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.20
country_id: 2750405
description:
Feb  3 02:49:55 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account png-sales@mckd.com.my has been temporarily locked by Imunify PAM(46.151.182.20)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 02:49:23 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:49:43 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51641: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:50:03 dovecot_login authenticator failed for H=(9vnDcGc85B) [165.154.235.118]:2403: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:50:10 dovecot_login authenticator failed for H=(ZwhhMe4) [178.16.52.139]:57705: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 02:50:19 dovecot_login authenticator failed for H=(4okYKR) [185.36.81.54]:55304: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.79.185.164
country_id: 2802361
description:
2026-02-03 02:50:48 dovecot_login authenticator failed for H=164.185.79.34.bc.googleusercontent.com (10.132.0.2) [34.79.185.164]:61514: 535 Incorrect authentication data (set_id=sham@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:50:54 dovecot_login authenticator failed for H=(PukZGT) [141.98.11.11]:56807: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 02:50:03 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47796: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/alsa/cards/Loopback.conf||User:root||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 02:50:45 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:50:47 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63174: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:50:51 dovecot_login authenticator failed for H=(weqU1jQM) [165.154.235.118]:2356: 535 Incorrect authentication data (set_id=penny)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:51:42 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58041: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 02:51:56 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 02:52:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:51:09 dovecot_login authenticator failed for H=(DGgOlY) [178.16.52.139]:61584: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/systemd/system.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:51:33 dovecot_login authenticator failed for H=(SOjSCrKRDB) [141.98.11.11]:64298: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.14
country_id: 2750405
description:
Feb  3 02:51:53 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account png-sales@mckd.com.my has been temporarily locked by Imunify PAM(46.151.182.14)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-03 02:51:53 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:63547: 535 Incorrect authentication data (set_id=cass@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:51:09 dovecot_login authenticator failed for H=(NqVZehiL7D) [165.154.235.118]:5006: 535 Incorrect authentication data (set_id=penny)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 02:51:29 dovecot_login authenticator failed for H=(kgdcsdDA) [185.36.81.54]:52214: 535 Incorrect authentication data (set_id=ind)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 02:52:12 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49592: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2026-02-03 02:52:16 dovecot_plain authenticator failed for H=c-98-40-101-10.hsd1.tn.comcast.net (surosterst) [98.40.101.10]:35606: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.232.114.71
country_id: 3469034
description:
2026-02-03 02:52:31 dovecot_login authenticator failed for H=(189-108-96-183.customer.tdatabrasil.net.br) [200.232.114.71]:44410: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.116.66
country_id: 1269750
description:
2026-02-03 02:52:43 dovecot_login authenticator failed for H=([182.95.87.80]) [182.95.116.66]:38370: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:52:12 dovecot_login authenticator failed for H=(DV89Ljzh) [165.154.235.118]:18397: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:52:24 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57982: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.198
country_id: 6252001
description:
2026-02-03  2:52:30 339228 [Warning] Aborted connection 339228 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.198' (This connection closed normally without authentication)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 02:52:45 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:52:11 dovecot_login authenticator failed for H=(seK5VE9p) [141.98.11.11]:53618: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.46.243.91
country_id: 6252001
description:
2026-02-03 02:52:13 dovecot_plain authenticator failed for H=(WIN-L37FT9GV4BT) [198.46.243.91]:50832: 535 Incorrect authentication data (set_id=kty.yap@manforce.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.22
country_id: 2750405
description:
Feb  3 02:52:43 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account png-sales@mckd.com.my has been temporarily locked by Imunify PAM(46.151.182.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:52:03 dovecot_login authenticator failed for H=(00s4zb) [178.16.52.139]:49607: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/osinfo/datamap/microsoft.com||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2026-02-03 02:52:20 dovecot_plain authenticator failed for H=c-73-213-237-28.hsd1.va.comcast.net (daeous) [73.213.237.28]:41822: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 02:52:27 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 02:52:36 H=(185.93.89.63) [185.93.89.63]:59796 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <tleeper@kukausa.com>: The mail server could not deliver mail to tleeper@kukausa.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:53:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51039: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 02:53:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/cwd/etc/apache2/conf.modules.d/450_mod_unique_id.conf||User:root||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 02:53:22 H=(185.93.89.63) [185.93.89.63]:59907 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <elizabeth.geiling@concordia-ny.edu>: The mail server could not deliver mail to elizabeth.geiling@concordia-ny.edu.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:53:18 dovecot_login authenticator failed for H=(KUSEzyly) [178.16.52.139]:52934: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 02:53:38 dovecot_login authenticator failed for H=(dUiBuEl) [185.36.81.54]:58394: 535 Incorrect authentication data (set_id=ind)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:53:08 dovecot_login authenticator failed for H=(FUKPlNBE) [165.154.235.118]:30917: 535 Incorrect authentication data


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:53:30 dovecot_login authenticator failed for H=(99xrtK8s) [165.154.235.118]:35875: 535 Incorrect authentication data


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 64.89.161.101
country_id: 2635167
description:
Feb  3 02:53:40 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account cky@ahfengineering.com has been temporarily locked by Imunify PAM(64.89.161.101)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.219.137
country_id: 6252001
description:
[2026-02-03 02:53:16 +0800] info [whostmgrd] 172.56.219.137 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:53:32 dovecot_login authenticator failed for H=(YWGv05kclq) [141.98.11.11]:56881: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.203.199.118
country_id: 1835841
description:
2026-02-03 02:54:07 dovecot_login authenticator failed for H=([175.203.199.118]) [175.203.199.118]:40553: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 02:54:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.189
country_id: 6252001
description:
2026-02-03 02:54:17 dovecot_login authenticator failed for H=([209.23.72.189]) [209.23.72.189]:57388: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 64.89.161.101
country_id: 2635167
description:
Feb  3 02:54:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account cky@ahfengineering.com has been temporarily locked by Imunify PAM(64.89.161.101)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 02:54:23 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55468: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:54:04 dovecot_login authenticator failed for H=(GMjWWGm) [165.154.235.118]:43562: 535 Incorrect authentication data


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 02:54:08 H=(185.93.89.63) [185.93.89.63]:60007 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <mike@cornforthcampbell.com>: The mail server could not deliver mail to mike@cornforthcampbell.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:54:14 dovecot_login authenticator failed for H=(PgdDCwPi) [178.16.52.139]:62872: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/dbus-1/system.d/org.freedesktop.systemd1.conf||User:root||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 02:54:24 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.210.68
country_id: 732800
description:
2026-02-03 02:54:46 dovecot_plain authenticator failed for H=(paptoing) [46.10.210.68]:49012: 535 Incorrect authentication data (set_id=bak@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:54:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59971: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 02:55:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 02:55:08 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:55:12 dovecot_login authenticator failed for H=(1hNZLB) [165.154.235.118]:58747: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:55:14 dovecot_login authenticator failed for H=(6wP79b) [141.98.11.11]:51580: 535 Incorrect authentication data (set_id=chuan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:55:17 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61100: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/dnf/protected.d/grub2-pc.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 02:55:35 dovecot_login authenticator failed for H=(MTBrEZ8GN) [185.36.81.54]:65474: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 02:55:45 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:55:10 dovecot_login authenticator failed for H=(xCLg1a7hee) [178.16.52.139]:54808: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:56:08 dovecot_login authenticator failed for H=(nfNK2F8) [165.154.235.118]:47791: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:56:18 dovecot_login authenticator failed for H=(g6atb4PAWQ) [141.98.11.11]:52428: 535 Incorrect authentication data (set_id=chuan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 02:56:31 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49596: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:56:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53804: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/lib/tmpfiles.d/journal-nocow.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:56:19 dovecot_login authenticator failed for H=(tmrXUM) [165.154.235.118]:50788: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:56:47 dovecot_login authenticator failed for H=(mH34WXQ) [178.16.52.139]:58884: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 02:56:25 H=(185.93.89.63) [185.93.89.63]:60644 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<kontakt@tvboenigen.ch> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <doug@appliededu.com>: The mail server could not deliver mail to doug@appliededu.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 02:56:54 dovecot_login authenticator failed for H=(DVvgIA2ja) [185.36.81.54]:65138: 535 Incorrect authentication data (set_id=ind)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:57:04 dovecot_login authenticator failed for H=(casMhP) [165.154.235.118]:20919: 535 Incorrect authentication data


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/tmpfiles.d/pcp-conf.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:57:13 dovecot_login authenticator failed for H=(oCa2qW) [178.16.52.139]:54489: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:57:39 dovecot_login authenticator failed for H=(upwivQ0kGB) [141.98.11.11]:63560: 535 Incorrect authentication data (set_id=chuan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 02:57:50 dovecot_login authenticator failed for H=(ZZWznYpxx3) [185.36.81.54]:58231: 535 Incorrect authentication data (set_id=ind)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 02:57:34 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 02:57:53 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:57:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59983: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2026-02-03 02:58:52 dovecot_plain authenticator failed for H=c-71-224-169-28.hsd1.pa.comcast.net (barates) [71.224.169.28]:50924: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/systemd/coredump.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:58:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53597: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:58:17 dovecot_login authenticator failed for H=(wZYy8FFsA) [141.98.11.11]:57007: 535 Incorrect authentication data (set_id=chuan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 02:58:19 dovecot_login authenticator failed for H=(EESv2HFh) [185.36.81.54]:65144: 535 Incorrect authentication data (set_id=ind)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 02:58:25 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 02:58:39 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:42844: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:58:45 dovecot_login authenticator failed for H=(SV4iqgafT) [165.154.235.118]:43451: 535 Incorrect authentication data


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 02:58:08 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:58:12 dovecot_login authenticator failed for H=(1D4GeQ4IcL) [165.154.235.118]:35802: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:58:12 dovecot_login authenticator failed for H=(BMtHMmdxf) [178.16.52.139]:57371: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-03 02:58:23 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:55281: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 02:59:08 dovecot_login authenticator failed for H=(Re42be) [165.154.235.118]:48594: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 02:59:10 dovecot_login authenticator failed for H=(1ACli9y5xb) [178.16.52.139]:57599: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/cwd/etc/trusted-key.key||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 02:59:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53515: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 02:59:32 dovecot_login authenticator failed for H=(vqfU3oF) [141.98.11.11]:50150: 535 Incorrect authentication data (set_id=chuan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 02:59:08 dovecot_login authenticator failed for H=(ElhT3i) [185.36.81.54]:58698: 535 Incorrect authentication data (set_id=ind)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.167
country_id: 690791
description:
2026-02-03 02:59:35 H=([77.83.39.167]) [77.83.39.167]:56087 F=<stevenwelboun@op.pl> rejected RCPT <gopro@oxbold.com>: No Such User Here


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:00:15 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62015: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.36.178.14
country_id: 1814991
description:
2026-02-03 03:00:30 dovecot_login authenticator failed for H=([58.19.210.43]) [119.36.178.14]:48087: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:00:32 dovecot_login authenticator failed for H=(6Bvoy86cRM) [185.36.81.54]:61790: 535 Incorrect authentication data (set_id=ind)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:00:09 dovecot_login authenticator failed for H=(P8uAg2) [178.16.52.139]:56201: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.15.132
country_id: 1814991
description:
2026-02-03 03:00:45 dovecot_login authenticator failed for H=([222.128.15.132]) [222.128.15.132]:56616: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 03:00:10 dovecot_login authenticator failed for H=(5ZVcQnI) [141.98.11.11]:58194: 535 Incorrect authentication data (set_id=chuan)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/cwd/lib64/cracklib_dict.pwd||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 03:00:04 dovecot_login authenticator failed for H=(N60tfc4) [165.154.235.118]:51678: 535 Incorrect authentication data


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 03:00:17 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 03:00:49 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44520: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 03:01:22 dovecot_login authenticator failed for H=(ITugYKnXI) [141.98.11.11]:56851: 535 Incorrect authentication data (set_id=chuan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.64.93.161
country_id: 2077456
description:
2026-02-03 03:01:39 dovecot_login authenticator failed for H=115-64-93-161.tpgi.com.au [115.64.93.161]:60861: 535 Incorrect authentication data (set_id=support@wohcheong.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 03:01:06 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 03:01:06 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 03:01:12 dovecot_login authenticator failed for H=(sGeNDn43) [165.154.235.118]:2442: 535 Incorrect authentication data


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 03:01:23 dovecot_login authenticator failed for H=(ebWp4jvoJc) [165.154.235.118]:4981: 535 Incorrect authentication data


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/home5/manfotp3/logs/roundcube/errors.log||User:manfotp3||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.172.106.105
country_id: 1814991
description:
2026-02-03 03:01:19 dovecot_login authenticator failed for H=([117.172.106.105]) [117.172.106.105]:45819: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:01:03 dovecot_login authenticator failed for H=(Bxhxo45) [77.83.39.164]:59454: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:01:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52004: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 03:01:46 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.162.111.205
country_id: 1835841
description:
2026-02-03 03:01:54 dovecot_login authenticator failed for H=([112.162.111.205]) [112.162.111.205]:51671: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-03 03:01:53 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:50059: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:01:14 dovecot_login authenticator failed for H=(fk8BxPL) [185.36.81.54]:55492: 535 Incorrect authentication data (set_id=bkooi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:01:16 dovecot_login authenticator failed for H=(uMIWuDH) [178.16.52.139]:50352: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2026-02-03 03:01:30 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-145.59.23.125.airtelbroadband.in) [182.95.227.70]:35450: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:02:20 dovecot_login authenticator failed for H=(aNp6J7w) [178.16.52.139]:58136: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.213.69.247
country_id: 1814991
description:
2026-02-03 03:02:20 dovecot_login authenticator failed for H=([127.0.0.1]) [139.213.69.247]:37446: 535 Incorrect authentication data (set_id=rina)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 03:02:22 dovecot_login authenticator failed for H=(sbpq3YMkLA) [141.98.11.11]:55951: 535 Incorrect authentication data (set_id=chuan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 03:03:01 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38394: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.210.174.157
country_id: 1814991
description:
2026-02-03 03:02:06 dovecot_login authenticator failed for H=([127.0.0.1]) [139.210.174.157]:49125: 535 Incorrect authentication data (set_id=rina@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:02:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60090: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 03:02:08 dovecot_login authenticator failed for H=(S0itele) [165.154.235.118]:32075: 535 Incorrect authentication data


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 03:02:15 H=(185.93.89.63) [185.93.89.63]:61742 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <hhasnaoui@radianinc.com>: The mail server could not deliver mail to hhasnaoui@radianinc.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 03:02:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:02:17 dovecot_login authenticator failed for H=(y9sZp8D0R) [77.83.39.164]:55926: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:02:14 dovecot_login authenticator failed for H=(1LksxrN) [185.36.81.54]:61347: 535 Incorrect authentication data (set_id=ind)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/cwd/etc/nfs.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:03:16 dovecot_login authenticator failed for H=(4hnbDDlvbd) [185.36.81.54]:62364: 535 Incorrect authentication data (set_id=bkooi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:03:07 dovecot_login authenticator failed for H=(G875oBJy) [77.83.39.164]:64156: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:03:35 dovecot_login authenticator failed for H=(mTd4GfOoe) [178.16.52.139]:61119: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:03:40 dovecot_login authenticator failed for H=(aKrHtM) [185.36.81.54]:65531: 535 Incorrect authentication data (set_id=bkooi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 03:03:04 dovecot_login authenticator failed for H=(rwzovm) [165.154.235.118]:44311: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 03:03:30 dovecot_login authenticator failed for H=(JyVbDgZ) [141.98.11.11]:54497: 535 Incorrect authentication data (set_id=chuan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:03:32 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57763: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 03:03:33 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.248.176.184
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=87091516783626 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 03:04:06 dovecot_login authenticator failed for H=(uH4U7kec) [141.98.11.11]:54623: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.36.81.54
country_id: 597427
description:
Feb  3 03:04:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bkooi has been locked for the attacker IP 185.36.81.54


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:04:03 dovecot_login authenticator failed for H=(j4OOqda) [185.36.81.54]:49852: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:04:22 dovecot_login authenticator failed for H=(RlH2zzlAy) [77.83.39.164]:57745: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.120.142.233
country_id: 2510769
description:
2026-02-03 03:04:39 dovecot_plain authenticator failed for H=(valies) [185.120.142.233]:42281: 535 Incorrect authentication data (set_id=sales2@ocned.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 03:04:59 H=(185.93.89.63) [185.93.89.63]:62184 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <jloehr@denveria.com>: The mail server could not deliver mail to jloehr@denveria.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 03:04:27 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13010
name: Delayed Multiple triggers of Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 03:04:35 H=(185.93.89.63) [185.93.89.63]:62076 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<mpnmjec@mpnmjec.ac.in> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <jloehr@denveria.com>: The mail server could not deliver mail to jloehr@denveria.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:04:04 dovecot_login authenticator failed for H=(e4otXc) [178.16.52.139]:49347: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/alsa/cards/TRID4DWAVENX.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 03:04:12 dovecot_login authenticator failed for H=(sBOdZvGZG) [165.154.235.118]:59678: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 03:04:31 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:04:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50234: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 03:05:14 dovecot_login authenticator failed for H=(QOzX2axO9) [141.98.11.11]:55002: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:05:07 dovecot_login authenticator failed for H=(Hv7CJ2i) [185.36.81.54]:62013: 535 Incorrect authentication data (set_id=ind)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.36.81.54
country_id: 597427
description:
Feb  3 03:05:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bkooi has been locked for the attacker IP 185.36.81.54


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.164
country_id: 690791
description:
Feb  3 03:05:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa has been locked for the attacker IP 77.83.39.164


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.11
country_id: 597427
description:
Feb  3 03:05:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account chuan@tschuan.com has been temporarily locked by Imunify PAM(141.98.11.11)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:05:22 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60885: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/cwd/etc/systemd/journald.conf||User:root||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 03:05:44 H=(185.93.89.63) [185.93.89.63]:62371 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <ggross@wvhcs.org>: The mail server could not deliver mail to ggross@wvhcs.org.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2026-02-03 03:05:13 dovecot_plain authenticator failed for H=c-24-23-125-83.hsd1.pa.comcast.net (dromantail) [24.23.125.83]:55188: 535 Incorrect authentication data (set_id=adeline@ocned.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 03:05:16 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.201.39
country_id: 1269750
description:
2026-02-03 03:05:21 dovecot_login authenticator failed for H=([117.248.201.39]) [117.248.201.39]:51923: 535 Incorrect authentication data (set_id=office@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 03:05:11 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50016: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:05:10 dovecot_login authenticator failed for H=(nnqHbrF) [77.83.39.164]:65008: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.128.241.207
country_id: 2661886
description:
2026-02-03 03:05:34 dovecot_login authenticator failed for H=195-128-241-207.bredband.obenetwork.net [195.128.241.207]:41755: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 03:05:08 dovecot_login authenticator failed for H=(QfMEDs8yX) [165.154.235.118]:7353: 535 Incorrect authentication data


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.11
country_id: 597427
description:
Feb  3 03:06:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account chuan@tschuan.com has been temporarily locked by Imunify PAM(141.98.11.11)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:06:03 dovecot_login authenticator failed for H=(LC8okvFokf) [185.36.81.54]:55458: 535 Incorrect authentication data (set_id=aoto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 03:06:04 dovecot_login authenticator failed for H=(yHgVSg) [165.154.235.118]:19702: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:06:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53331: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:06:20 dovecot_login authenticator failed for H=(sAkhmaV8) [178.16.52.139]:61827: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.164
country_id: 690791
description:
Feb  3 03:06:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa has been locked for the attacker IP 77.83.39.164


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 03:06:23 dovecot_login authenticator failed for H=(NUxiI5K1) [141.98.11.11]:65397: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 03:06:55 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/alsa/cards/ICE1724.conf||User:root||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.36.81.54
country_id: 597427
description:
Feb  3 03:06:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bkooi has been locked for the attacker IP 185.36.81.54


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:06:19 dovecot_login authenticator failed for H=(bq3e0rLG) [185.36.81.54]:63821: 535 Incorrect authentication data (set_id=bkooi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:06:23 dovecot_login authenticator failed for H=(EdfCboyxP) [77.83.39.164]:50178: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 03:07:30 dovecot_login authenticator failed for H=(zbuEZ5N) [141.98.11.11]:50497: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/alsa/cards/SB-XFi.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 03:07:19 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54064: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 03:07:12 dovecot_login authenticator failed for H=(jCHB8eD4S) [165.154.235.118]:35064: 535 Incorrect authentication data


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 03:07:26 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:07:03 dovecot_login authenticator failed for H=(Lj3X1ATpCo) [185.36.81.54]:50012: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:07:11 dovecot_login authenticator failed for H=(5YsxJtlpQ) [77.83.39.164]:59437: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.11
country_id: 597427
description:
Feb  3 03:07:28 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account chuan@tschuan.com has been temporarily locked by Imunify PAM(141.98.11.11)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:07:44 dovecot_login authenticator failed for H=(lZeVFRWmfC) [178.16.52.139]:52081: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:07:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61610: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.164
country_id: 690791
description:
Feb  3 03:07:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa has been locked for the attacker IP 77.83.39.164


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.36.81.54
country_id: 597427
description:
Feb  3 03:07:29 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bkooi has been locked for the attacker IP 185.36.81.54


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 03:07:40 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:08:25 dovecot_login authenticator failed for H=(MwirbdmDwL) [77.83.39.164]:49177: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:08:03 dovecot_login authenticator failed for H=(tyUyjV3) [185.36.81.54]:65529: 535 Incorrect authentication data (set_id=bkooi)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/alsa-card-profile/mixer/paths/hdmi-output-9.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 03:08:08 dovecot_login authenticator failed for H=(Zb59Oi) [165.154.235.118]:47499: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.36.81.54
country_id: 597427
description:
Feb  3 03:08:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bkooi has been locked for the attacker IP 185.36.81.54


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.164
country_id: 690791
description:
Feb  3 03:08:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa has been locked for the attacker IP 77.83.39.164


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.11
country_id: 597427
description:
Feb  3 03:08:27 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account chuan@tschuan.com has been temporarily locked by Imunify PAM(141.98.11.11)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 03:08:29 dovecot_login authenticator failed for H=(q695Dv) [141.98.11.11]:59672: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:08:32 dovecot_login authenticator failed for H=(bnGsQUl) [185.36.81.54]:55407: 535 Incorrect authentication data (set_id=bkooi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.196.144.45
country_id: 1814991
description:
2026-02-03 03:08:55 dovecot_login authenticator failed for H=([183.196.144.45]) [183.196.144.45]:32813: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:08:15 dovecot_login authenticator failed for H=(u9Qte1nbB) [178.16.52.139]:56699: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 03:08:27 H=(185.93.89.63) [185.93.89.63]:62897 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <dmcdonald@crja.com>: The mail server could not deliver mail to dmcdonald@crja.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:08:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60524: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 03:09:04 dovecot_login authenticator failed for H=(0MXdzfnKx5) [165.154.235.118]:63859: 535 Incorrect authentication data (set_id=penny)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 03:09:04 dovecot_login authenticator failed for H=(srGSYKXkq) [141.98.11.11]:64228: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/alsa-card-profile/mixer/paths/hdmi-output-2.conf||User:root||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.118
country_id: 6252001
description:
Feb  3 03:09:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account penny has been locked for the attacker IP 165.154.235.118


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:09:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53077: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.121.147
country_id: 690791
description:
2026-02-03 03:09:28 dovecot_login authenticator failed for H=(82.193.121.147.ipnet.ua) [82.193.121.147]:55524: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 03:09:38 H=(185.93.89.63) [185.93.89.63]:63101 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <grussell@johncarroll.loyola.edu>: The mail server could not deliver mail to grussell@johncarroll.loyola.edu.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 03:09:51 dovecot_login authenticator failed for H=(FWnuPAN) [165.154.235.118]:6795: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:09:50 dovecot_login authenticator failed for H=(5WZ7aAAyw) [178.16.52.139]:50403: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.164
country_id: 690791
description:
Feb  3 03:09:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa has been locked for the attacker IP 77.83.39.164


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:09:16 dovecot_login authenticator failed for H=(d06feWZw89) [185.36.81.54]:62670: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.11
country_id: 597427
description:
Feb  3 03:09:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account chuan@tschuan.com has been temporarily locked by Imunify PAM(141.98.11.11)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:09:13 dovecot_login authenticator failed for H=(cVQYZZp) [77.83.39.164]:61580: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 03:09:29 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57680: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.19.165.90
country_id: 3469034
description:
2026-02-03 03:10:58 dovecot_login authenticator failed for H=(secovi-rs.pae.gvt.net.br) [177.19.165.90]:34581: 535 Incorrect authentication data (set_id=admin@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 03:10:05 dovecot_login authenticator failed for H=(g6bb0Zfa) [141.98.11.11]:52599: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 03:10:08 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:10:08 dovecot_login authenticator failed for H=(Nkd2qDVsb2) [185.36.81.54]:56871: 535 Incorrect authentication data (set_id=bkooi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:10:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62038: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 03:10:02 dovecot_login authenticator failed for H=(qabhxCVlE6) [165.154.235.118]:9288: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:10:19 dovecot_login authenticator failed for H=(g5JDW0) [178.16.52.139]:52835: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:10:25 dovecot_login authenticator failed for H=(G1tAhbqZ) [77.83.39.164]:50312: 535 Incorrect authentication data (set_id=mustapa)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/demos/img/img/clientele.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/alsa-card-profile/mixer/paths/analog-input-aux.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.204.150.91
country_id: 1814991
description:
2026-02-03 03:10:14 dovecot_login authenticator failed for H=([121.204.150.91]) [121.204.150.91]:56624: 535 Incorrect authentication data (set_id=postmaster@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:11:13 dovecot_login authenticator failed for H=(Cl4xHj) [185.36.81.54]:53703: 535 Incorrect authentication data (set_id=bkooi)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/home4/manfotp3/etc/manforce.net/manforce.admin.rcube.db||User:manfotp3||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.244
country_id: 1168579
description:
2026-02-03 03:11:08 dovecot_login authenticator failed for H=([103.148.92.244]) [103.148.92.244]:33714: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:11:10 dovecot_login authenticator failed for H=(QF58hGO) [178.16.52.139]:56378: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-03 03:11:12 dovecot_login authenticator failed for H=(auoPMaA4) [141.98.11.11]:63473: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:11:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63122: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 03:11:38 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35824: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 03:11:11 H=(185.93.89.63) [185.93.89.63]:63452 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <joyce.lortz@cygnusexpos.com>: The mail server could not deliver mail to joyce.lortz@cygnusexpos.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 03:11:09 dovecot_login authenticator failed for H=(Bs2JHFl7y) [165.154.235.118]:24831: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2026-02-03 03:11:52 dovecot_plain authenticator failed for H=c-73-197-236-163.hsd1.nj.comcast.net (uphyloelie) [73.197.236.163]:35844: 535 Incorrect authentication data (set_id=adeline@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:11:13 dovecot_login authenticator failed for H=(ZawEGbbknd) [77.83.39.164]:57346: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 03:12:28 dovecot_login authenticator failed for H=(QMlmevki) [165.154.235.118]:43212: 535 Incorrect authentication data


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/fonts/conf.d/11-lcdfilter-default.conf||User:root||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 03:12:52 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 03:12:04 H=(185.93.89.63) [185.93.89.63]:63723 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <jack@mrstm.com>: The mail server could not deliver mail to jack@mrstm.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 03:12:06 dovecot_login authenticator failed for H=(SzW5d9g) [178.16.52.139]:59864: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:12:09 dovecot_login authenticator failed for H=(FgEl3bbuhS) [185.36.81.54]:61423: 535 Incorrect authentication data (set_id=bkooi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-02-03 03:12:02 dovecot_login authenticator failed for H=(jNUkuDBA4) [77.83.39.164]:49313: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.36.81.54
country_id: 597427
description:
Feb  3 03:12:51 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bkooi has been locked for the attacker IP 185.36.81.54


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-02-03 03:12:06 dovecot_login authenticator failed for H=(X2EiszXaQV) [165.154.235.118]:37971: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 03:12:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55223: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.212.211.10
country_id: 1880251
domain: empirelog.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home2/empi7862/public_html/wp-admin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/lib/imunify360/events.db/001342.log||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.24.15.88
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/images/8162P_IFOAM_Standard_Certificate_220817.pdf HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.36.81.54
country_id: 597427
description:
Feb  3 03:13:41 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bkooi has been locked for the attacker IP 185.36.81.54


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-03 03:13:03 dovecot_login authenticator failed for H=(Xoaw5C5d5d) [185.36.81.54]:52447: 535 Incorrect authentication data (set_id=aoto)


