# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.162
country_id: 1733045
description:
2026-01-31 16:19:17 dovecot_login authenticator failed for H=([49.124.155.162]) [49.124.155.162]:50010: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:19:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:19:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hock has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:19:07 dovecot_login authenticator failed for H=(Sna3t7gaL) [158.94.208.175]:58153: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.237.134
country_id: 1269750
description:
2026-01-31 16:20:03 dovecot_login authenticator failed for H=(aes-static-097.196.22.125.airtel.in) [125.23.237.134]:50430: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:20:13 dovecot_login authenticator failed for H=(Bym2ly) [158.94.208.175]:52446: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:20:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:20:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:20:15 dovecot_login authenticator failed for H=(i9ZVq7c) [158.94.208.215]:49368: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:20:15 dovecot_login authenticator failed for H=(ufpDSq34Th) [158.94.208.215]:49370: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
country_id: 1814991
description:
2026-01-31 16:20:15 dovecot_login authenticator failed for H=([39.165.183.70]) [39.165.183.70]:33246: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 16:20:25 dovecot_login authenticator failed for H=(YDvEDx) [178.16.54.22]:63865: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 16:20:30 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:21:03 dovecot_login authenticator failed for H=(kSs7asuLAh) [158.94.208.215]:58268: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:21:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.50
country_id: 2921044
description:
2026-01-31 16:21:33 dovecot_login authenticator failed for H=(oJ17Ac) [77.90.185.50]:60990: 535 Incorrect authentication data (set_id=info@mams.manforce.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.90.185.50
country_id: 2921044
description:
Jan 31 16:21:39 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(77.90.185.50)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:21:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:21:26 dovecot_login authenticator failed for H=(SScdnhjI9H) [158.94.208.175]:51141: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 16:21:26 dovecot_login authenticator failed for H=(eIBdH4Epm) [178.16.54.22]:51246: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:22:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:22:15 dovecot_login authenticator failed for H=(C3iqEEcXrw) [158.94.208.215]:62383: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 16:22:32 dovecot_login authenticator failed for H=(PE6aw0) [178.16.54.22]:53607: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:22:03 dovecot_login authenticator failed for H=(cUKk42yu) [158.94.208.175]:50875: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-01-31 16:22:07 dovecot_login authenticator failed for H=(RMDcLs) [185.36.81.54]:49412: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:22:15 dovecot_login authenticator failed for H=(ebhkerBx2) [158.94.208.215]:62399: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:23:03 dovecot_login authenticator failed for H=(Xvlumo) [158.94.208.215]:57770: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:23:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 16:23:30 H=([167.148.167.71]) [167.148.167.71]:64856 F=<Support@nexuscollection.com> rejected RCPT <admin@nexuscollection.com>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-01-31 16:23:44 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:49420: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:23:10 dovecot_login authenticator failed for H=(rFPAUmH5WH) [158.94.208.175]:54498: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:24:15 dovecot_login authenticator failed for H=(DuudJSe) [158.94.208.215]:59114: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 16:24:04 dovecot_login authenticator failed for H=(AYcgsLagD) [178.16.54.22]:49919: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:24:07 dovecot_login authenticator failed for H=(EDnzIhLQz2) [158.94.208.175]:62487: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:24:15 dovecot_login authenticator failed for H=(UZAgOT6cN) [158.94.208.215]:59115: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:25:02 dovecot_login authenticator failed for H=(RPiPDJwq) [158.94.208.175]:62040: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:25:03 dovecot_login authenticator failed for H=(1HN6H9vijI) [158.94.208.215]:49981: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.231.82
country_id: 1269750
description:
2026-01-31 16:25:48 dovecot_login authenticator failed for H=([182.95.231.82]) [182.95.231.82]:39802: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:25:51 dovecot_login authenticator failed for H=(2AHEhl5) [158.94.208.215]:56726: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.80.228.231
country_id: 6252001
description:
2026-01-31 16:25:57 dovecot_login authenticator failed for H=([129.80.228.231]) [129.80.228.231]:36208: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:26:15 dovecot_login authenticator failed for H=(jfPG379M10) [158.94.208.215]:51146: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.104.201.40
country_id: 1814991
description:
2026-01-31 16:26:51 dovecot_plain authenticator failed for H=(iv4f95gt4jh5fz26y48fomg8r) [39.104.201.40]:33554: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 16:26:28 dovecot_login authenticator failed for H=(yGWn5U) [178.16.54.22]:50609: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:26:27 dovecot_login authenticator failed for H=(gMSlneta) [158.94.208.175]:53820: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-01-31 16:26:57 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:59400: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.219.163.233
country_id: 953987
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=595675 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:26:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hock has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-01-31 16:26:36 dovecot_login authenticator failed for H=(BNLvYNy9if) [185.36.81.54]:62512: 535 Incorrect authentication data (set_id=png-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.64.3.94
country_id: 1269750
description:
2026-01-31 16:27:09 dovecot_login authenticator failed for H=(aes-static-049.93.22.125.airtel.in) [182.64.3.94]:36170: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:27:17 dovecot_login authenticator failed for H=(xovKROUVL) [158.94.208.175]:56856: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:27:03 dovecot_login authenticator failed for H=(EAgCH797) [158.94.208.215]:60355: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.63.7.250
country_id: 2921044
description:
2026-01-31 16:27:51 dovecot_login authenticator failed for H=p5b3f07fa.dip0.t-ipconnect.de [91.63.7.250]:62868: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:27:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hock has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-01-31 16:27:42 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:19094: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:27:51 dovecot_login authenticator failed for H=(dFBcSK) [158.94.208.215]:52881: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 182.42.113.10
country_id: 1814991
description:
Jan 31 16:28:34 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(182.42.113.10)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 16:28:06 dovecot_login authenticator failed for H=(GX6VesVpAD) [178.16.54.22]:56348: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:28:12 dovecot_login authenticator failed for H=(HtM9Pdtz) [158.94.208.175]:60092: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:28:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
country_id: 1814991
description:
2026-01-31 16:28:36 dovecot_login authenticator failed for H=([182.42.113.10]) [182.42.113.10]:42856: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-01-31 16:28:46 dovecot_login authenticator failed for H=(wGhoPE) [185.36.81.54]:63019: 535 Incorrect authentication data (set_id=png-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.163.189.191
country_id: 2017370
description:
2026-01-31 16:28:04 dovecot_login authenticator failed for H=([46.163.189.191]) [46.163.189.191]:47510: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:28:15 dovecot_login authenticator failed for H=(iNJ6ccwua) [158.94.208.215]:63389: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:29:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hock has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 103.107.36.18
country_id: 1269750
description:
Jan 31 16:29:51 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(103.107.36.18)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:29:51 dovecot_login authenticator failed for H=(v6BhcwYQUY) [158.94.208.215]:57914: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 16:29:13 dovecot_login authenticator failed for H=(0mvarxW) [178.16.54.22]:55168: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-01-31 16:29:30 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:60948: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-01-31 16:29:53 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:44650: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:29:03 dovecot_login authenticator failed for H=(4KFTk9D) [158.94.208.215]:49381: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:29:07 dovecot_login authenticator failed for H=(G5KiZquJ) [158.94.208.175]:53472: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 116.113.193.70
country_id: 1814991
description:
Jan 31 16:30:29 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(116.113.193.70)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-31 16:30:31 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:63444: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.176.183
country_id: 1861060
domain: mail.smartcable.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home/smartcable/public_html/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 16:30:29 dovecot_login authenticator failed for H=(iUpeDfVQ) [178.16.54.22]:62529: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 16:30:44 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:30:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:30:15 dovecot_login authenticator failed for H=(DhTrePo) [158.94.208.215]:51475: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:30:15 dovecot_login authenticator failed for H=(1Ukh9Xqr) [158.94.208.175]:63708: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.195.77.177
country_id: 1835841
description:
2026-01-31 16:30:17 dovecot_login authenticator failed for H=([119.195.77.177]) [119.195.77.177]:47301: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.176.183
country_id: 1861060
domain: mail.smartcable.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/smartcable/public_html/wp-content||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:31:27 dovecot_login authenticator failed for H=(4ajzs9Geiz) [158.94.208.215]:56404: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 16:31:28 dovecot_login authenticator failed for H=(74JUKsvqj) [178.16.54.22]:60160: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 16:31:48 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/demos/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:31:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.38.130
country_id: 1210997
description:
2026-01-31 16:31:38 dovecot_login authenticator failed for H=([49.0.38.130]) [49.0.38.130]:43980: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 123.136.105.37
country_id: 1733045
domain: advisorygroup.com.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.71||T:APACHE||RA:123.136.105.37||TA:123.136.105.37||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:31:12 dovecot_login authenticator failed for H=(WD7Rnr4thj) [158.94.208.175]:62349: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:31:03 dovecot_login authenticator failed for H=(RUZzjX) [158.94.208.215]:59509: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2026-01-31 16:31:27 dovecot_login authenticator failed for H=([152.52.236.122]) [152.52.236.122]:53144: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 16:32:26 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 16:32:36 H=([167.148.167.71]) [167.148.167.71]:57392 F=<Support@nexuscollection.com> rejected RCPT <alex@nexuscollection.com>: smtp auth required


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/demos/img/new-development.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:32:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 16:32:14 dovecot_login authenticator failed for H=(YqxwE3hA) [178.16.54.22]:50834: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:32:15 dovecot_login authenticator failed for H=(sI5uhlBZ) [158.94.208.215]:63343: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:32:18 dovecot_login authenticator failed for H=(TPJd1s4dT) [158.94.208.175]:56449: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:33:02 dovecot_login authenticator failed for H=(KNCuc3A2) [158.94.208.175]:63613: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.254.25.158
country_id: 2017370
description:
2026-01-31 16:33:15 dovecot_login authenticator failed for H=([46.254.25.158]) [46.254.25.158]:53146: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 16:33:05 dovecot_login authenticator failed for H=(byeIFg) [178.16.54.22]:62336: 535 Incorrect authentication data (set_id=limls)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2026-01-31 16:33:23 dovecot_login authenticator failed for H=(nsg-static-97.152.75.182-airtel.com) [27.123.111.110]:33922: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:33:03 dovecot_login authenticator failed for H=(40Hw2dnvR) [158.94.208.215]:55250: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:33:27 dovecot_login authenticator failed for H=(oVS1s3V) [158.94.208.215]:51228: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:34:05 dovecot_login authenticator failed for H=(r3TiElWuR) [158.94.208.175]:59359: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2026-01-31 16:34:12 dovecot_login authenticator failed for H=(173-25-186-130.client.mchsi.com) [173.25.186.130]:60255: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.137.66.82
country_id: 1835841
description:
2026-01-31 16:34:12 dovecot_login authenticator failed for H=([125.137.66.82]) [125.137.66.82]:1189: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 16:34:04 dovecot_login authenticator failed for H=(6R37go) [178.16.54.22]:63777: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-01-31 16:34:06 dovecot_login authenticator failed for H=(pbmnmMpaAA) [185.36.81.54]:58109: 535 Incorrect authentication data (set_id=png-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:34:15 dovecot_login authenticator failed for H=(KwJ82VV2) [158.94.208.215]:56386: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.124.111.122
country_id: 2077456
description:
2026-01-31 16:34:26 dovecot_login authenticator failed for H=27-124-111-122.static.as58511.net [27.124.111.122]:55587: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:35:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hock has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:35:27 dovecot_login authenticator failed for H=(UoxumPGc0) [158.94.208.215]:64408: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:35:03 dovecot_login authenticator failed for H=(nKAQa5G1) [158.94.208.215]:65396: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 16:35:13 dovecot_login authenticator failed for H=(4c19lKNgT) [178.16.54.22]:50850: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:35:16 dovecot_login authenticator failed for H=(iZYgUrhRk) [158.94.208.175]:52464: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:35:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.108.13
country_id: 1814991
description:
2026-01-31 16:36:31 dovecot_login authenticator failed for H=([119.6.108.13]) [119.6.108.13]:43399: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.72.92.174
country_id: 1814991
description:
2026-01-31 16:36:18 dovecot_login authenticator failed for H=([125.72.92.174]) [125.72.92.174]:43745: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.31.19
country_id: 718075
description:
2026-01-31 16:36:19 dovecot_plain authenticator failed for H=([10.239.0.128]) [185.225.31.19]:24402: 535 Incorrect authentication data (set_id=payment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.82
country_id: 1269750
description:
2026-01-31 16:37:44 dovecot_login authenticator failed for H=(nsg-corporate-82.230.187.122.airtel.in) [122.187.230.82]:41008: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:37:46 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:37:46 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.31.25
country_id: 718075
description:
2026-01-31 16:37:06 dovecot_plain authenticator failed for H=([10.170.0.131]) [185.225.31.25]:55822: 535 Incorrect authentication data (set_id=payment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-01-31 16:37:11 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:43782: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.39.82
country_id: 1814991
description:
2026-01-31 16:37:29 dovecot_login authenticator failed for H=([60.174.39.82]) [60.174.39.82]:60152: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:37:48 dovecot_login authenticator failed for H=(rWEIapcxR) [158.94.208.215]:54756: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:37:57 dovecot_login authenticator failed for H=(MMXidQB) [158.94.208.175]:55418: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.122.255.5
country_id: 1814991
description:
2026-01-31 16:38:00 dovecot_login authenticator failed for H=([118.122.255.5]) [118.122.255.5]:54424: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.5
country_id: 1814991
description:
2026-01-31 16:37:07 dovecot_login authenticator failed for H=([111.61.97.5]) [111.61.97.5]:29834: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:38:14 dovecot_login authenticator failed for H=(HONtO9u) [158.94.208.175]:49597: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:38:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:38:08 dovecot_login authenticator failed for H=(P3fFuvCTDt) [158.94.208.215]:56632: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:38:46 dovecot_login authenticator failed for H=(UJNGNw) [158.94.208.215]:53146: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:38:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.202.245.25
country_id: 1210997
description:
2026-01-31 16:38:07 dovecot_login authenticator failed for H=([203.202.245.25]) [203.202.245.25]:36217: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:39:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hock has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:39:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.194
country_id: 1269750
description:
2026-01-31 16:39:05 dovecot_login authenticator failed for H=(nsg-corporate-194.230.187.122.airtel.in) [122.187.230.194]:38698: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.170.15
country_id: 3175395
description:
2026-01-31 16:39:33 dovecot_plain authenticator failed for H=([100.64.100.6]) [2.57.170.15]:19744: 535 Incorrect authentication data (set_id=wanfazris@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:39:05 dovecot_login authenticator failed for H=(UMax5xz) [158.94.208.215]:62489: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.232.11
country_id: 1814991
description:
2026-01-31 16:40:56 dovecot_login authenticator failed for H=([27.45.232.11]) [27.45.232.11]:54624: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:40:02 dovecot_login authenticator failed for H=(sR7jXs) [158.94.208.215]:49285: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.170
country_id: 1814991
description:
2026-01-31 16:40:06 dovecot_login authenticator failed for H=([116.114.84.170]) [116.114.84.170]:36787: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.4.199.164
country_id: 1814991
description:
2026-01-31 16:40:10 dovecot_login authenticator failed for H=(164.199.4.122.broad.wf.sd.dynamic.163data.com.cn) [122.4.199.164]:39074: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:40:21 dovecot_login authenticator failed for H=(kc0YSs) [158.94.208.215]:63310: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77350391
name: IM360 WAF: Interaction with fake plugin
abuser: 62.146.235.10
country_id: 1880251
domain: www.saps.com.my
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/pwnd.php||WPU:||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.186.136.36
country_id: 1814991
description:
2026-01-31 16:41:12 dovecot_login authenticator failed for H=([61.186.136.36]) [61.186.136.36]:52973: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:41:18 dovecot_login authenticator failed for H=(nsjEZsJ7n) [158.94.208.215]:50632: 535 Incorrect authentication data (set_id=hock)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 62.146.235.10
country_id: 1880251
domain: www.saps.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/sapscom/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
country_id: 1814991
description:
2026-01-31 16:41:39 dovecot_login authenticator failed for H=([116.113.254.26]) [116.113.254.26]:50108: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:41:37 dovecot_login authenticator failed for H=(ORZtH3) [158.94.208.215]:56266: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:42:15 dovecot_login authenticator failed for H=(azfr0J) [158.94.208.215]:64542: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.87.152
country_id: 1814991
description:
2026-01-31 16:42:28 dovecot_login authenticator failed for H=([111.61.87.152]) [111.61.87.152]:35826: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 16:42:36 H=([167.148.167.71]) [167.148.167.71]:62203 F=<Support@aoto.com.my> rejected RCPT <aoto@aoto.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
country_id: 1814991
description:
2026-01-31 16:42:45 dovecot_login authenticator failed for H=([220.178.39.106]) [220.178.39.106]:48544: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:42:51 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
country_id: 1814991
description:
2026-01-31 16:42:14 dovecot_login authenticator failed for H=([39.165.183.70]) [39.165.183.70]:60786: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:43:12 dovecot_login authenticator failed for H=(MV41GAtl) [158.94.208.215]:51261: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.107.16
country_id: 1269750
description:
2026-01-31 16:43:42 dovecot_login authenticator failed for H=(nsg-static-16.107.76.182-airtel.com) [182.76.107.16]:41688: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.118.190.204
country_id: 1835841
description:
2026-01-31 16:43:54 dovecot_login authenticator failed for H=([220.118.190.204]) [220.118.190.204]:38708: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:43:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:43:12 dovecot_login authenticator failed for H=(lAL5tmh) [158.94.208.215]:51258: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:44:09 dovecot_login authenticator failed for H=(Gw6sv4vpTN) [158.94.208.215]:62206: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-01-31 16:44:35 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:55372: 535 Incorrect authentication data (set_id=fasya)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.17.217.141
country_id: 1814991
description:
2026-01-31 16:44:44 dovecot_login authenticator failed for H=([218.17.217.141]) [218.17.217.141]:62654: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.100.88
country_id: 1814991
description:
2026-01-31 16:44:51 dovecot_login authenticator failed for H=([111.26.100.88]) [111.26.100.88]:51470: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:44:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-01-31 16:44:17 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:40960: 535 Incorrect authentication data (set_id=fasya@pftfood.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/malaysia-infinity-design-projects/residential/images/awards.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.1.56
country_id: 2017370
description:
2026-01-31 16:44:22 dovecot_login authenticator failed for H=broadband-5-228-1-56.ip.moscow.rt.ru [5.228.1.56]:58034: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:44:47 dovecot_login authenticator failed for H=(0moTIQFi0) [158.94.208.215]:57976: 535 Incorrect authentication data (set_id=hock)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 185.156.46.146
country_id: 6252001
domain: www.smartcable.com.my
description:
IM360 WAF: Possible XSS in arguments||MV:240641') and 1=1 union all select 1,null,'<script>alert(\"xss\")</script>',table_name from information_schema.tables where 2>1--/**/; exec xp_cmdshell('cat ../../../etc/passwd')#||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77211700
name: IM360 WAF: Detects conditional SQL injection attempts
abuser: 185.156.46.146
country_id: 6252001
domain: www.smartcable.com.my
description:
IM360 WAF: Detects conditional SQL injection attempts||RSV:7.71||T:APACHE||MVN:MATCHED_VAR||MV:240641/**//**/AND/**/1/**/GROUP/**/BY/**/CONCAT(0x5a4f3061,(SELECT/**/(ELT(2836=2836,1))),0x34644b46,FLOOR(RAND(0)*2))/**/HAVING/**/MIN(0)#||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.56
country_id: 1269750
description:
2026-01-31 16:45:09 dovecot_login authenticator failed for H=(nsg-corporate-56.234.187.122.airtel.in) [122.187.234.56]:47617: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.32.39.139
country_id: 2510769
description:
2026-01-31 16:45:23 dovecot_login authenticator failed for H=139.red-83-32-39.dynamicip.rima-tde.net [83.32.39.139]:55903: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 185.156.46.146
country_id: 6252001
domain: www.smartcable.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:240641/**//**/or/**/(select/**/2*(if((select/**/*/**/from/**/(select/**/concat(0x5143354f,(select/**/(elt(2836=2836,1))),0x5a7a4a45))s),/**/8446744073709551610,/**/8446744073709551610)))||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.230
country_id: 1149361
description:
2026-01-31 16:45:44 dovecot_login authenticator failed for H=([149.54.51.230]) [149.54.51.230]:35143: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 185.156.46.146
country_id: 6252001
domain: www.smartcable.com.my
description:
IM360 WAF: PHP Injection Low value||MV:240641/**//**/AND/**/EXP(~(SELECT/**/*/**/FROM/**/(SELECT/**/CONCAT(0x68534b66,(SELECT/**/(ELT(2836=2836,1))),0x4473595a))x))||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home/smartcable/public_html/news-details.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.156.38
country_id: 1605651
description:
2026-01-31 16:45:02 dovecot_login authenticator failed for H=mail.sotus.co.th [171.100.156.38]:36172: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:45:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 122.187.228.228
country_id: 1269750
description:
Jan 31 16:45:37 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(122.187.228.228)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 185.156.46.146
country_id: 6252001
domain: www.smartcable.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:240641') and 1=1 union all select 1,null,'<script>alert(\"xss\")</etc/passwd')#||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 185.156.46.146
country_id: 6252001
domain: www.smartcable.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:240641') AND 1=1 UNION ALL SELECT 1,NULL,'<script>alert(\"XSS\")</script>',table_name FROM information_schema.tables WHERE 2>1--/**/; EXEC xp_cmdshell('cat ../../../etc/passwd')#||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.231.66
country_id: 1269750
description:
2026-01-31 16:45:36 dovecot_login authenticator failed for H=([182.95.231.66]) [182.95.231.66]:55872: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2026-01-31 16:45:39 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:45628: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:45:06 dovecot_login authenticator failed for H=(2MUXjfsrW) [158.94.208.215]:55107: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.138.178
country_id: 1814991
description:
2026-01-31 16:45:10 dovecot_login authenticator failed for H=([39.152.138.178]) [39.152.138.178]:54695: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 185.156.46.146
country_id: 6252001
domain: www.smartcable.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:240641') AND 1=1 UNION ALL SELECT 1,NULL,'<script>alert(\"XSS\")</script>',table_name FROM information_schema.tables WHERE 2>1--/**/; EXEC xp_cmdshell('cat ../../../etc/passwd')#||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77211700
name: IM360 WAF: Detects conditional SQL injection attempts
abuser: 185.156.46.146
country_id: 6252001
domain: www.smartcable.com.my
description:
IM360 WAF: Detects conditional SQL injection attempts||RSV:7.71||T:APACHE||MVN:MATCHED_VAR||MV:240641 /**/'/**/OR/**/1/**/GROUP/**/BY/**/CONCAT(0x52505777,(SELECT/**/REPEAT(0x33,150)),0x4f783549,FLOOR(RAND(0)*2))/**/HAVING/**/MIN(0)##/**/XE3W||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:46:03 dovecot_login authenticator failed for H=(0h4IKeq) [158.94.208.215]:49601: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:46:03 dovecot_login authenticator failed for H=(K5MErun) [158.94.208.215]:49587: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2026-01-31 16:46:26 dovecot_login authenticator failed for H=([65.20.233.110]) [65.20.233.110]:60396: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.7
country_id: 1668284
description:
2026-01-31 16:46:40 dovecot_login authenticator failed for H=111-70-32-7.emome-ip.hinet.net [111.70.32.7]:33018: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 185.156.46.146
country_id: 6252001
domain: www.smartcable.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:240641 /**/'/**/or/**/1/**/group/**/by/**/concat(0x52505777,(select/**/repeat(0x33,150)),0x4f783549,floor(rand(0)*2))/**/having/**/min(0)##/**/xe3w||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 185.156.46.146
country_id: 6252001
domain: www.smartcable.com.my
description:
IM360 WAF: PHP Injection Low value||MV:240641 /**/'/**/OR/**/1/**/GROUP/**/BY/**/CONCAT(0x52505777,(SELECT/**/REPEAT(0x33,150)),0x4f783549,FLOOR(RAND(0)*2))/**/HAVING/**/MIN(0)##/**/XE3W||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home/smartcable/public_html/news-details.php||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 185.156.46.146
country_id: 6252001
domain: www.smartcable.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:240641 /**/'/**/OR/**/1/**/GROUP/**/BY/**/CONCAT(0x52505777,(SELECT/**/REPEAT(0x33,150)),0x4f783549,FLOOR(RAND(0)*2))/**/HAVING/**/MIN(0)##/**/XE3W||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:46:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hock has been locked for the attacker IP 158.94.208.215


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 185.156.46.146
country_id: 6252001
domain: www.smartcable.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:240641 /**/'/**/or/**/1/**/group/**/by/**/concat(0x52505777,(select/**/repeat(0x33,150)),0x4f783549,floor(rand(0)*2))/**/having/**/min(0)##/**/xe3w||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.228.24.35
country_id: 6252001
description:
2026-01-31 16:46:13 dovecot_login authenticator failed for H=(ADMIN) [140.228.24.35]:50443: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 16:46:41 dovecot_login authenticator failed for H=(fDPYVVYqzU) [69.5.189.21]:62059: 535 Incorrect authentication data (set_id=kl.tai@nmahir.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-01-31 16:47:25 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:54570: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 16:47:05 dovecot_login authenticator failed for H=(b9CcQAA) [69.5.189.21]:49550: 535 Incorrect authentication data (set_id=kl.tai@nmahir.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:47:19 dovecot_login authenticator failed for H=(ArVU9AXdK) [158.94.208.215]:52232: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.188
country_id: 1814991
description:
2026-01-31 16:47:04 dovecot_login authenticator failed for H=([111.61.177.188]) [111.61.177.188]:50920: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 50.235.31.47
country_id: 6252001
description:
Jan 31 16:47:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(50.235.31.47)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:47:38 dovecot_login authenticator failed for H=(Ju2hBizyTj) [158.94.208.215]:58246: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:47:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hock has been locked for the attacker IP 158.94.208.215


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 217.182.79.131
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/img/img/demos/img/demos/img/photos/contact-us.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:48:16 dovecot_login authenticator failed for H=(7VRvbmg4) [158.94.208.215]:52090: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 16:48:38 dovecot_login authenticator failed for H=(3ASpWHaimN) [69.5.189.21]:64914: 535 Incorrect authentication data (set_id=kl.tai@nmahir.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:49:13 dovecot_login authenticator failed for H=(dueQxR) [158.94.208.215]:51080: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.220.169.176
country_id: 2017370
description:
2026-01-31 16:49:55 dovecot_login authenticator failed for H=(31-220-169-176.rdtc.ru) [31.220.169.176]:44301: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 16:49:02 dovecot_login authenticator failed for H=(39B3bTt2u) [69.5.189.21]:52503: 535 Incorrect authentication data (set_id=kl.tai@nmahir.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.6.250.242
country_id: 6252001
description:
2026-01-31 16:49:36 dovecot_login authenticator failed for H=(ADMIN) [50.6.250.242]:41852: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:49:13 dovecot_login authenticator failed for H=(ED8O7Juviq) [158.94.208.215]:51079: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 16:49:18 H=([167.148.167.71]) [167.148.167.71]:50861 F=<Support@astlog.com.my> rejected RCPT <astpkg@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 16:50:35 dovecot_login authenticator failed for H=(rbpjLN6zQ0) [69.5.189.21]:51646: 535 Incorrect authentication data (set_id=kl.tai@nmahir.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:50:46 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:50:10 dovecot_login authenticator failed for H=(n7ml27cdp) [158.94.208.215]:55228: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.175.54.146
country_id: 6252001
domain: af-sb.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.71||T:APACHE||RA:192.175.54.146||TA:192.175.54.146||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.100.159.2
country_id: 1835841
description:
2026-01-31 16:50:24 dovecot_login authenticator failed for H=([222.100.159.2]) [222.100.159.2]:58122: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:50:29 dovecot_login authenticator failed for H=(W0yBO69gE) [158.94.208.215]:51291: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.175.182
country_id: 357994
description:
2026-01-31 16:52:00 dovecot_login authenticator failed for H=([41.65.118.172]) [154.177.175.182]:37972: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 16:51:22 dovecot_login authenticator failed for H=(KMeuBU) [69.5.189.21]:59520: 535 Incorrect authentication data (set_id=kl.tai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.195.53.129
country_id: 6252001
description:
2026-01-31 16:51:33 dovecot_login authenticator failed for H=([74.195.53.129]) [74.195.53.129]:33916: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.92.124.2
country_id: 1269750
description:
2026-01-31 16:51:40 dovecot_login authenticator failed for H=(static.bb.ill.59.92.124.2.bsnl.in) [59.92.124.2]:40129: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.249.20.14
country_id: 1814991
description:
2026-01-31 16:51:56 dovecot_login authenticator failed for H=([140.249.20.14]) [140.249.20.14]:42875: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-01-31 16:51:28 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:58464: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.233.181
country_id: 2017370
description:
2026-01-31 16:51:02 dovecot_login authenticator failed for H=(ipoe-static.mosoblast.rt.ru) [89.109.233.181]:39778: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:51:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hock has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:51:07 dovecot_login authenticator failed for H=(dOTtGpM) [158.94.208.215]:58564: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.92.202
country_id: 1269750
description:
2026-01-31 16:51:13 dovecot_login authenticator failed for H=([152.52.238.54]) [27.123.92.202]:42732: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 211.228.113.27
country_id: 1835841
description:
Jan 31 16:51:26 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(211.228.113.27)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:52:05 dovecot_login authenticator failed for H=(oRqLVu5) [158.94.208.215]:62155: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.85.183
country_id: 690791
description:
2026-01-31 16:52:06 dovecot_login authenticator failed for H=(host183-85-16-178.reedlan.com) [178.16.85.183]:50269: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:52:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:52:05 dovecot_login authenticator failed for H=(3hee1uDUi) [158.94.208.215]:62150: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.134
country_id: 2017370
description:
2026-01-31 16:52:14 dovecot_login authenticator failed for H=([178.178.194.134]) [178.178.194.134]:39874: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:53:02 dovecot_login authenticator failed for H=(YoR4syRt9r) [158.94.208.215]:53475: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.122.239
country_id: 3469034
description:
2026-01-31 16:53:23 dovecot_login authenticator failed for H=([187.50.118.81]) [177.174.122.239]:55019: 535 Incorrect authentication data (set_id=teng@pftfood.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.203.132.68
country_id: 2658434
domain: fasterget.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/fastg/public_html/wp-admin||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.231.100
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=211364 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.246.238
country_id: 1814991
description:
2026-01-31 16:53:49 dovecot_login authenticator failed for H=([218.21.246.238]) [218.21.246.238]:59880: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:53:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:53:40 dovecot_login authenticator failed for H=(GqqV7AaMND) [158.94.208.215]:53930: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:54:56 dovecot_login authenticator failed for H=(yRzHLawsgt) [158.94.208.215]:51532: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.8.226.231
country_id: 1643084
description:
2026-01-31 16:54:57 dovecot_plain authenticator failed for H=(CUF28CYXYG583UI9) [182.8.226.231]:45193: 535 Incorrect authentication data (set_id=francis.info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.203.132.68
country_id: 2658434
domain: fasterget.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/index.php||SC:/home2/fastg/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:54:18 dovecot_login authenticator failed for H=(EV2thvb1) [158.94.208.215]:64725: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:54:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:55:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
country_id: 2017370
description:
2026-01-31 16:55:54 dovecot_login authenticator failed for H=([95.79.108.51]) [95.79.108.51]:37714: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.8.226.231
country_id: 1643084
description:
2026-01-31 16:55:03 dovecot_login authenticator failed for H=(CUF28CYXYG583UI9) [182.8.226.231]:45193: 535 Incorrect authentication data (set_id=francis.info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.169.24
country_id: 1861060
domain: mokshana.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home/mokshanacom/public_html/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:55:15 dovecot_login authenticator failed for H=(aYHrax0G) [158.94.208.215]:56179: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.42
country_id: 1733045
description:
2026-01-31 16:56:13 dovecot_login authenticator failed for H=([49.124.146.42]) [49.124.146.42]:49894: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.145.5.14
country_id: 1835841
description:
2026-01-31 16:56:28 dovecot_login authenticator failed for H=([221.145.5.14]) [221.145.5.14]:58941: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.98
country_id: 1814991
description:
2026-01-31 16:56:38 dovecot_login authenticator failed for H=([1.30.20.98]) [1.30.20.98]:44008: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-01-31 16:56:55 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:41420: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.169.24
country_id: 1861060
domain: mokshana.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/mokshanacom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.109.136
country_id: 660013
description:
2026-01-31 16:56:36 dovecot_login authenticator failed for H=([45.82.109.136]) [45.82.109.136]:40484: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-01-31 16:56:45 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:36484: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.54.82
country_id: 1269750
description:
2026-01-31 16:56:07 dovecot_login authenticator failed for H=(dsl-tn-dynamic-201.116.246.61.airtelbroadband.in) [122.187.54.82]:44990: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 16:57:43 H=([167.148.167.71]) [167.148.167.71]:55734 F=<Support@ms-chemicals.net> rejected RCPT <boolan@ms-chemicals.net>: smtp auth required


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 147.135.252.182
country_id: 3017382
domain: krisfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/webdesign.monkeymedia2u.com||User:krisfood||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 16:57:42 dovecot_login authenticator failed for H=(iM0dfX9Ty) [178.16.54.22]:62963: 535 Incorrect authentication data (set_id=tinghou)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.237.122.116
country_id: 99237
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=10 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 16:58:16 dovecot_login authenticator failed for H=(ftiP4rAQV) [178.16.54.22]:60207: 535 Incorrect authentication data (set_id=tinghou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.225.220
country_id: 1269750
description:
2026-01-31 16:58:44 dovecot_login authenticator failed for H=(nsg-corporate-220.225.187.122.airtel.in) [122.187.225.220]:37248: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.182.65.40
country_id: 3017382
description:
2026-01-31 16:58:52 dovecot_login authenticator failed for H=40.ip-217-182-65.eu [217.182.65.40]:57266: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.74.12.86
country_id: 1269750
description:
2026-01-31 16:58:49 dovecot_login authenticator failed for H=([182.74.12.86]) [182.74.12.86]:45044: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 16:59:23 dovecot_login authenticator failed for H=(l9sWKNZ) [178.16.54.22]:55369: 535 Incorrect authentication data (set_id=tinghou)


plugin: modsec
rule: 77140880
name: IM360 WAF: Infectors: PHP Injection Attack
abuser: 144.172.92.223
country_id: 6252001
domain: masaakisb.com
description:


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 144.172.92.223
country_id: 6252001
domain: masaakisb.com
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:7.71||T:APACHE||SC:/home/masaakisb/public_html/wp-content/plugins/about.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-01-31 16:59:04 dovecot_login authenticator failed for H=(azteca-comunicaciones.com) [201.46.124.0]:2353: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 144.172.92.223
country_id: 6252001
domain: masaakisb.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/inputs.php||SC:/home/masaakisb/public_html/wp-content/uploads/inputs.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-01-31 17:01:30 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:47362: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 144.172.92.223
country_id: 6252001
domain: masaakisb.com
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:7.71||T:APACHE||SC:/home/masaakisb/public_html/geju.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.203.132.68
country_id: 2658434
domain: www.wcc.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/woh/wcc.com.my/wp-admin/images/commentv.php||


plugin: modsec
rule: 77140880
name: IM360 WAF: Infectors: PHP Injection Attack
abuser: 144.172.92.223
country_id: 6252001
domain: masaakisb.com
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-31 17:01:33 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:58916: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:01:40 dovecot_login authenticator failed for H=(lLIWw7K8y) [178.16.54.22]:54666: 535 Incorrect authentication data (set_id=tinghou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-31 17:01:53 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:33862: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-01-31 17:01:52 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:40850: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.33
country_id: 1819730
description:
2026-01-31 17:02:49 dovecot_login authenticator failed for H=(223-197-145-33.static.imsbiz.com) [223.197.145.33]:51143: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.203.132.68
country_id: 2658434
domain: www.wcc.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/wp-conflg.php||SC:/home2/woh/wcc.com.my/wp-admin/images/wp-conflg.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.130.200.86
country_id: 1814991
description:
2026-01-31 17:03:29 dovecot_login authenticator failed for H=([220.189.239.206]) [61.130.200.86]:46266: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.123.92.130
country_id: 6252001
description:
2026-01-31 17:03:04 dovecot_login authenticator failed for H=([50.123.92.130]) [50.123.92.130]:42260: 535 Incorrect authentication data (set_id=aziz)


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 144.172.92.223
country_id: 6252001
domain: masaakisb.com
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:7.71||T:APACHE||SC:/home/masaakisb/public_html/wp.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:03:16 dovecot_login authenticator failed for H=(6gVSwd) [178.16.54.22]:59723: 535 Incorrect authentication data (set_id=tinghou)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 17:03:21 H=([167.148.167.71]) [167.148.167.71]:62782 F=<Support@ktlog.com.my> rejected RCPT <celine@ktlog.com.my>: smtp auth required


plugin: modsec
rule: 77140880
name: IM360 WAF: Infectors: PHP Injection Attack
abuser: 144.172.92.223
country_id: 6252001
domain: masaakisb.com
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
country_id: 1814991
description:
2026-01-31 17:03:09 dovecot_login authenticator failed for H=([39.165.183.70]) [39.165.183.70]:40526: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.58
country_id: 2017370
description:
2026-01-31 17:03:59 dovecot_login authenticator failed for H=([178.178.222.58]) [178.178.222.58]:49298: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:04:42 dovecot_login authenticator failed for H=(xB93Hbu) [178.16.54.22]:65206: 535 Incorrect authentication data (set_id=tinghou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.135.251.22
country_id: 2017370
description:
2026-01-31 17:04:57 dovecot_login authenticator failed for H=([79.135.251.22]) [79.135.251.22]:38834: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.164.93.136
country_id: 6252001
description:
2026-01-31 17:04:09 dovecot_login authenticator failed for H=(syn-024-164-093-136.res.spectrum.com) [24.164.93.136]:41303: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
country_id: 1835841
description:
2026-01-31 17:04:36 dovecot_login authenticator failed for H=([211.223.41.90]) [211.223.41.90]:51888: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2026-01-31 17:05:00 dovecot_login authenticator failed for H=syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:57721: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.34
country_id: 1269750
description:
2026-01-31 17:04:06 dovecot_login authenticator failed for H=(nsg-corporate-78.223.187.122.airtel.in) [182.66.214.34]:58426: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-31 17:04:15 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:13707: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.186.68.153
country_id: 1814991
description:
2026-01-31 17:04:20 dovecot_login authenticator failed for H=([222.186.68.153]) [222.186.68.153]:44519: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.93.75.196
country_id: 1269750
description:
2026-01-31 17:04:44 dovecot_plain authenticator failed for H=(398XN2FAL8) [59.93.75.196]:52220: 535 Incorrect authentication data (set_id=joyo@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.233.190
country_id: 1835841
description:
2026-01-31 17:05:31 dovecot_login authenticator failed for H=([106.10.69.50]) [183.108.233.190]:46921: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:05:20 dovecot_login authenticator failed for H=(u4K8pgq) [178.16.54.22]:65306: 535 Incorrect authentication data (set_id=tinghou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.228.160
country_id: 149590
description:
2026-01-31 17:05:22 dovecot_login authenticator failed for H=(160.228-59-41.static-zone.ttcldata.net) [41.59.228.160]:43170: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 101.200.243.197
country_id: 1814991
description:
2026-01-31 17:05:21 44165 [Warning] Aborted connection 44165 to db: 'unconnected' user: 'unauthenticated' host: '101.200.243.197' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.47.16.15
country_id: 1880251
description:
2026-01-31 17:06:23 dovecot_plain authenticator failed for H=(t7tdmb838ootj8csk7v) [101.47.16.15]:36182: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.200.184.216
country_id: 248816
description:
2026-01-31 17:06:03 dovecot_plain authenticator failed for H=(56QUULLY) [149.200.184.216]:28121: 535 Incorrect authentication data (set_id=kelveen.info@tst-ma.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-01-31 17:06:17 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:17435: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 17:06:03 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:49588: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:07:55 dovecot_login authenticator failed for H=(8SlWtn) [178.16.54.22]:65372: 535 Incorrect authentication data (set_id=tinghou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2026-01-31 17:07:07 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:60819: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-31 17:07:30 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:48834: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.62
country_id: 1269750
description:
2026-01-31 17:08:44 dovecot_login authenticator failed for H=(nsg-corporate-209.240.186.122.airtel.in) [27.123.97.62]:51554: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:09:00 dovecot_login authenticator failed for H=(dffnZWe4r) [178.16.54.22]:57650: 535 Incorrect authentication data (set_id=tinghou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.150
country_id: 1269750
description:
2026-01-31 17:08:39 dovecot_login authenticator failed for H=(nsg-corporate-150.230.187.122.airtel.in) [122.187.230.150]:44553: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-31 17:08:13 H=([45.144.212.50]) [45.144.212.50]:51418 F=<ccmsservice@bangkokbank.com> rejected RCPT <khim@ktlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from bangkokbank.com


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 44.236.207.248
country_id: 6252001
domain: ahfengineering.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/142.0.0.0 Safari/537.36||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.30.250.62
country_id: 690791
description:
2026-01-31 17:08:53 dovecot_login authenticator failed for H=(undefined.sevstar.net) [78.30.250.62]:58070: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.204.162.16
country_id: 1269750
description:
2026-01-31 17:08:28 dovecot_plain authenticator failed for H=(Q3OS5) [49.204.162.16]:32449: 535 Incorrect authentication data (set_id=lilian@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:09:36 dovecot_login authenticator failed for H=(VqatqX5glE) [178.16.54.22]:61654: 535 Incorrect authentication data (set_id=tinghou)


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 10.1.14.100
description:
Jan 31 17:10:16 sv3 sshd[112509]: Accepted publickey for root from 10.1.14.100 port 62516 ssh2: RSA SHA256:WdDh84n9i7OwfL83TC4Q9y94bNOmxYGU2yeZfrTsxL0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:10:24 dovecot_login authenticator failed for H=(2N6fq4bt6) [178.16.54.22]:64630: 535 Incorrect authentication data (set_id=tinghou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.109.66.101
country_id: 1527747
description:
2026-01-31 17:10:57 dovecot_plain authenticator failed for H=(GXA8DC) [213.109.66.101]:53461: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.109.66.101
country_id: 1527747
description:
2026-01-31 17:11:03 dovecot_login authenticator failed for H=(GXA8DC) [213.109.66.101]:53461: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:11:06 dovecot_login authenticator failed for H=(zo0Qx4) [178.16.54.22]:55420: 535 Incorrect authentication data (set_id=tinghou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:12:42 dovecot_login authenticator failed for H=(zNhwWesp) [178.16.54.22]:51299: 535 Incorrect authentication data (set_id=tinghou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 17:13:24 dovecot_login authenticator failed for H=(y6KTInvM) [158.94.208.110]:61849: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.255.221
country_id: 1835841
description:
2026-01-31 17:13:35 dovecot_login authenticator failed for H=([218.146.255.221]) [218.146.255.221]:59445: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 168.149.98.56
country_id: 102358
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/root/lib/modprobe.d/dist-alsa.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-01-31 17:13:45 dovecot_login authenticator failed for H=(azteca-comunicaciones.com) [201.46.124.0]:1276: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:13:15 dovecot_login authenticator failed for H=(Ul9905) [178.16.54.22]:60810: 535 Incorrect authentication data (set_id=tinghou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2026-01-31 17:13:22 dovecot_login authenticator failed for H=(nsg-corporate-126.176.185.122.airtel.in) [122.185.176.126]:33862: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 17:13:36 H=([167.148.167.71]) [167.148.167.71]:61636 F=<Support@ajplantations.com.my> rejected RCPT <corporate_ch@ajplantations.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 17:14:12 dovecot_login authenticator failed for H=(SGm5Q73dVp) [158.94.208.110]:52585: 535 Incorrect authentication data (set_id=azakaria.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.89.151
country_id: 660013
description:
2026-01-31 17:14:37 dovecot_login authenticator failed for H=(ADMIN) [188.126.89.151]:45113: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.81
country_id: 1269750
description:
2026-01-31 17:14:02 dovecot_login authenticator failed for H=(nsg-corporate-81.230.187.122.airtel.in) [122.187.230.81]:52143: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:14:11 dovecot_login authenticator failed for H=(6s7Q037B) [178.16.54.22]:51053: 535 Incorrect authentication data (set_id=tinghou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2026-01-31 17:15:48 dovecot_login authenticator failed for H=(nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:39619: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2026-01-31 17:15:56 dovecot_login authenticator failed for H=(nsg-corporate-54.222.187.122.airtel.in) [122.187.222.54]:36520: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
country_id: 3469034
description:
2026-01-31 17:15:02 dovecot_login authenticator failed for H=([181.233.140.250]) [181.233.140.250]:59260: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 17:15:45 dovecot_login authenticator failed for H=(kOWtIS0) [158.94.208.110]:51439: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.118.112.230
country_id: 6252001
description:
2026-01-31 17:15:29 dovecot_login authenticator failed for H=syn-070-118-112-230.biz.spectrum.com [70.118.112.230]:44887: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.218.97
country_id: 1814991
description:
2026-01-31 17:15:43 dovecot_login authenticator failed for H=([111.26.218.96]) [111.26.218.97]:39114: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:15:17 dovecot_login authenticator failed for H=(C1AHMQWRT) [178.16.54.22]:57748: 535 Incorrect authentication data (set_id=tinghou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-31 17:16:46 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:45646: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.126.223.175
country_id: 2017370
description:
2026-01-31 17:16:05 dovecot_login authenticator failed for H=([92.126.223.175]) [92.126.223.175]:41522: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:16:53 dovecot_login authenticator failed for H=(f3USJ4sKiZ) [178.16.54.22]:53787: 535 Incorrect authentication data (set_id=tinghou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.130.200.86
country_id: 1814991
description:
2026-01-31 17:16:29 dovecot_login authenticator failed for H=([220.189.239.206]) [61.130.200.86]:57716: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/photos/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 17:16:09 dovecot_login authenticator failed for H=(VILNzSKf) [158.94.208.110]:55481: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.216.202
country_id: 1269750
domain: dps-comsec.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:60513.dps-comsec.com||ServerName:dps-comsec.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5e2f8aa3db42525ade25476e342c1ecfcb2970b3||Title:0x658dc991||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.254.92
country_id: 3865483
description:
2026-01-31 17:17:53 dovecot_login authenticator failed for H=(static.92.254.104.190.cps.com.ar) [190.104.254.92]:45414: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.91.179.26
country_id: 732800
description:
2026-01-31 17:17:55 dovecot_login authenticator failed for H=(213-91-179-26.btc-net.bg) [213.91.179.26]:36228: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.51
country_id: 1733045
description:
2026-01-31 17:17:09 dovecot_login authenticator failed for H=([49.124.151.51]) [49.124.151.51]:55372: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:17:27 dovecot_login authenticator failed for H=(wKHAGJ39PT) [178.16.54.22]:56569: 535 Incorrect authentication data (set_id=tinghou)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.176.183
country_id: 1861060
domain: xls.mokshana.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home/mokshanacom/xls.mokshana.com.my/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:20:01 dovecot_login authenticator failed for H=(bgmVbq) [178.16.54.22]:62127: 535 Incorrect authentication data (set_id=tinghou)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.176.183
country_id: 1861060
domain: xls.mokshana.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/mokshanacom/xls.mokshana.com.my/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.71.41
country_id: 6252001
description:
2026-01-31 17:20:26 dovecot_login authenticator failed for H=([209.23.71.41]) [209.23.71.41]:33306: 535 Incorrect authentication data (set_id=zainuddin)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 147.235.221.164
country_id: 294640
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/root/lib/modprobe.d/dist-blacklist.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:20:45 dovecot_login authenticator failed for H=(svLzHIYL) [178.16.54.22]:63585: 535 Incorrect authentication data (set_id=tinghou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 17:20:46 dovecot_login authenticator failed for H=(J0XEho02L6) [69.5.189.21]:55833: 535 Incorrect authentication data (set_id=steven@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/fphortier/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.185.190
country_id: 1269750
description:
2026-01-31 17:20:13 dovecot_login authenticator failed for H=(nsg-corporate-190.185.185.122.airtel.in) [122.185.185.190]:60870: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 17:21:09 dovecot_login authenticator failed for H=(PH1sn4cD6) [69.5.189.21]:59717: 535 Incorrect authentication data (set_id=steven@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.78.117.160
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=6 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:21:45 dovecot_login authenticator failed for H=(IxgTj9) [178.16.54.22]:61131: 535 Incorrect authentication data (set_id=tinghou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2026-01-31 17:22:50 dovecot_login authenticator failed for H=(1522312565.colombiatel.co) [152.231.25.64]:45504: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.138.74
country_id: 1269750
description:
2026-01-31 17:22:27 dovecot_login authenticator failed for H=([128.185.241.213]) [125.19.138.74]:50688: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: kdiballoon.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/kdiballo1/public_html/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.163.174.216
country_id: 2017370
description:
2026-01-31 17:22:42 dovecot_login authenticator failed for H=([46.163.174.216]) [46.163.174.216]:32944: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:22:18 dovecot_login authenticator failed for H=(R20GrvW) [178.16.54.22]:55289: 535 Incorrect authentication data (set_id=tinghou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.237.183.81
country_id: 690791
description:
2026-01-31 17:22:48 dovecot_login authenticator failed for H=([91.237.183.81]) [91.237.183.81]:51412: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 17:22:42 dovecot_login authenticator failed for H=(64KjF8esQc) [69.5.189.21]:58184: 535 Incorrect authentication data (set_id=steven@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.250
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/css/swiper.min.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.22
country_id: 1269750
description:
2026-01-31 17:23:54 dovecot_login authenticator failed for H=([182.95.20.31]) [182.95.228.22]:58136: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.189
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/js/popper.min.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.243
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/js/wow.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.166
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/css/animate.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.0.127.130
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=12581514861377 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.216
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/js/owl.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.240
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/fonts/fa-brands-400.woff2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.148
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/css/owl.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.220
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/fonts/fa-solid-900.woff2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.154
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/js/swiper.min.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.214
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/js/script.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.188
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/js/appear.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.159
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/css/flaticon.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.109
country_id: 1819730
description:
2026-01-31 17:23:37 dovecot_login authenticator failed for H=109.43.246.220.static.netvigator.com [220.246.43.109]:57571: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:23:55 dovecot_login authenticator failed for H=(jmwMss6) [178.16.54.22]:61775: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.251
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/js/jquery.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.204
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/css/tm-utility-classes.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.234
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/js/bootstrap.min.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.231
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/js/jquery.fancybox.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.153
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/css/tm-bs-mp.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.202
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/css/linear.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.128.55.250
country_id: 1814991
description:
2026-01-31 17:23:07 dovecot_login authenticator failed for H=([219.128.55.250]) [219.128.55.250]:59777: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.82.86
country_id: 1880251
description:
2026-01-31 17:23:30 dovecot_login authenticator failed for H=(86.82.156.175.unknown.m1.com.sg) [175.156.82.86]:38529: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.230
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/css/responsive.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.201
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/css/style.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.234.246
country_id: 1835841
description:
2026-01-31 17:23:44 dovecot_login authenticator failed for H=([112.164.234.246]) [112.164.234.246]:38338: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2026-01-31 17:23:07 dovecot_login authenticator failed for H=([172.191.74.151]) [172.191.74.151]:32968: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.227
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/js/jquery-ui.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 17:23:06 dovecot_login authenticator failed for H=(ewq1PH) [69.5.189.21]:61876: 535 Incorrect authentication data (set_id=steven@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.126.158.156
country_id: 630336
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/corporate-profile.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.239
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/css/bootstrap.min.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.196
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/js/select2.min.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 17:24:39 dovecot_login authenticator failed for H=(E04mA2As) [69.5.189.21]:60384: 535 Incorrect authentication data (set_id=steven@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/demos/img/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.249.7.24
country_id: 953987
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=88451514882760 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 17:25:03 dovecot_login authenticator failed for H=(yhaJvm) [69.5.189.21]:59471: 535 Incorrect authentication data (set_id=steven@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/languages/images/sliders/images/sliders/radioactive.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:25:34 dovecot_login authenticator failed for H=(CCTPMaIwhB) [178.16.54.22]:61732: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 154.84.220.181
country_id: 1269750
domain: ds-staffing.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:76536.ds-staffing.com||ServerName:ds-staffing.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:797d42cc551fc9ed095b73f5414c3470143855fe||Title:0x6b46f179||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-01-31 17:26:52 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:34642: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-31 17:26:56 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:52065: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:26:49 dovecot_login authenticator failed for H=(IGQqxRbJaf) [178.16.54.22]:50824: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2026-01-31 17:26:52 dovecot_login authenticator failed for H=([172.191.74.151]) [172.191.74.151]:52574: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.255.50.88
country_id: 2017370
description:
2026-01-31 17:27:14 dovecot_login authenticator failed for H=88-50-255-130.kamensktel.ru [130.255.50.88]:52952: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-31 17:27:23 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:56561: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.233.181
country_id: 2017370
description:
2026-01-31 17:27:23 dovecot_login authenticator failed for H=(ipoe-static.mosoblast.rt.ru) [89.109.233.181]:55239: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.189
country_id: 1814991
description:
2026-01-31 17:27:45 dovecot_login authenticator failed for H=([111.61.177.189]) [111.61.177.189]:17976: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.28.143
country_id: 1668284
description:
2026-01-31 17:27:48 dovecot_login authenticator failed for H=111-70-28-143.emome-ip.hinet.net [111.70.28.143]:49030: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-01-31 17:27:28 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:34188: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:27:28 dovecot_login authenticator failed for H=(QDVEQA0IH) [178.16.54.22]:62405: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2026-01-31 17:27:21 dovecot_login authenticator failed for H=([221.209.48.203]) [221.209.48.203]:44766: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.170.15
country_id: 3175395
description:
2026-01-31 17:27:21 dovecot_plain authenticator failed for H=([100.64.100.6]) [2.57.170.15]:5384: 535 Incorrect authentication data (set_id=zulkifli.abdul-mutalib@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-31 17:27:39 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:50278: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.199.172.66
country_id: 1814991
description:
2026-01-31 17:27:46 dovecot_login authenticator failed for H=([221.199.172.66]) [221.199.172.66]:47102: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:28:11 dovecot_login authenticator failed for H=(EGk1OkCZzH) [178.16.54.22]:64109: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.107.237.126
country_id: 1835841
description:
2026-01-31 17:28:06 dovecot_login authenticator failed for H=([211.107.237.126]) [211.107.237.126]:52004: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 17:28:48 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:57687: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/demos/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.203.111
country_id: 298795
description:
2026-01-31 17:29:56 dovecot_login authenticator failed for H=([5.26.203.111]) [5.26.203.111]:60684: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:29:21 dovecot_login authenticator failed for H=(GEktMHK) [178.16.54.22]:61187: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 17:30:47 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:57639: 535 Incorrect authentication data (set_id=test@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2026-01-31 17:30:12 dovecot_login authenticator failed for H=107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:13192: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.202.38.185
country_id: 2658434
description:
2026-01-31 17:30:03 dovecot_login authenticator failed for H=(dyn-cable-cust.185.38.202.213.quicknet.ch) [213.202.38.185]:53228: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:30:28 dovecot_login authenticator failed for H=(YLgKLIWYP7) [178.16.54.22]:50333: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/demos/img/img/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-31 17:30:08 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:59750: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.242
country_id: 1814991
description:
2026-01-31 17:30:39 dovecot_login authenticator failed for H=([111.61.176.242]) [111.61.176.242]:56708: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.7
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/run/blkid/blkid.tab.old||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:31:03 dovecot_login authenticator failed for H=(9C5P5Xj) [178.16.54.22]:61174: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.170.126
country_id: 1814991
description:
2026-01-31 17:31:08 dovecot_login authenticator failed for H=([220.180.170.126]) [220.180.170.126]:60202: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.213
country_id: 1269750
description:
2026-01-31 17:31:20 dovecot_login authenticator failed for H=(nsg-corporate-213.230.187.122.airtel.in) [122.187.230.213]:38387: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-31 17:31:01 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:53473: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.246.68.220
country_id: 1835841
description:
2026-01-31 17:32:35 dovecot_login authenticator failed for H=([49.246.68.220]) [49.246.68.220]:60708: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 17:32:14 H=([167.148.167.71]) [167.148.167.71]:54840 F=<Support@u-net.com.my> rejected RCPT <eddy@u-net.com.my>: SPF: 167.148.167.71 is not allowed to send mail from u-net.com.my


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:32:15 dovecot_login authenticator failed for H=(XdpVWj) [178.16.54.22]:63855: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2026-01-31 17:32:22 dovecot_login authenticator failed for H=([218.149.235.152]) [218.149.235.152]:47632: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
country_id: 1835841
description:
2026-01-31 17:32:12 dovecot_login authenticator failed for H=([175.206.113.91]) [175.206.113.91]:53718: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-01-31 17:33:28 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:45492: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-31 17:33:45 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:28007: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.108.162.24
country_id: 3469034
description:
2026-01-31 17:33:47 dovecot_login authenticator failed for H=([131.108.162.24]) [131.108.162.24]:46024: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:33:24 dovecot_login authenticator failed for H=(Gf0xLaezuC) [178.16.54.22]:58797: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2026-01-31 17:34:02 dovecot_login authenticator failed for H=([125.16.31.25]) [152.52.236.122]:54070: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:34:10 dovecot_login authenticator failed for H=(yjyKID) [178.16.54.22]:57678: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.132.42.170
country_id: 1814991
description:
2026-01-31 17:34:13 dovecot_login authenticator failed for H=([116.132.42.170]) [116.132.42.170]:56092: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:35:07 dovecot_login authenticator failed for H=(kRanKkz) [178.16.54.22]:54254: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.115.113.138
country_id: 1814991
description:
2026-01-31 17:35:13 dovecot_login authenticator failed for H=([27.115.113.138]) [27.115.113.138]:32836: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.235.192.130
country_id: 1835841
description:
2026-01-31 17:35:14 dovecot_login authenticator failed for H=([1.235.192.130]) [1.235.192.130]:41027: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.157.158
country_id: 1269750
description:
2026-01-31 17:35:25 dovecot_login authenticator failed for H=([128.185.217.150]) [125.19.157.158]:54178: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.1.110.201
country_id: 1562822
description:
2026-01-31 17:35:04 dovecot_login authenticator failed for H=([42.1.110.201]) [42.1.110.201]:60178: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 17:36:59 H=([167.148.167.71]) [167.148.167.71]:52729 F=<Support@tujusetia.my> rejected RCPT <engkong.wee@tujusetia.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:36:21 dovecot_login authenticator failed for H=(81ekqLYDNq) [178.16.54.22]:58819: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.22
country_id: 1269750
description:
2026-01-31 17:37:05 dovecot_login authenticator failed for H=([122.184.136.185]) [182.95.181.22]:48630: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2026-01-31 17:37:13 dovecot_login authenticator failed for H=([182.95.227.70]) [182.95.227.70]:39886: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:38:52 dovecot_login authenticator failed for H=(WMCfqFm6uT) [178.16.54.22]:53930: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2026-01-31 17:38:59 dovecot_login authenticator failed for H=([83.239.84.130]) [83.239.84.130]:47302: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.172
country_id: 1733045
description:
2026-01-31 17:39:25 dovecot_login authenticator failed for H=([49.124.152.172]) [49.124.152.172]:57664: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:39:28 dovecot_login authenticator failed for H=(3X2UMTfg) [185.169.4.188]:50324: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.190.238.234
country_id: 2017370
description:
2026-01-31 17:39:31 dovecot_login authenticator failed for H=(91-190-238-234.in-addr.netone.ru) [91.190.238.234]:33842: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2026-01-31 17:39:40 dovecot_login authenticator failed for H=static-200-105-141-172.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.172]:60674: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:39:27 dovecot_login authenticator failed for H=(Z0nkz8re) [178.16.54.22]:61228: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-01-31 17:39:30 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:43656: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2026-01-31 17:40:00 dovecot_login authenticator failed for H=177.162.84.34.bc.googleusercontent.com [34.84.162.177]:58902: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.252.42.171
country_id: 1835841
description:
2026-01-31 17:39:09 dovecot_login authenticator failed for H=([211.252.42.171]) [211.252.42.171]:60654: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-01-31 17:40:52 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:55898: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:40:02 dovecot_login authenticator failed for H=(GQXYRb) [185.169.4.188]:56538: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.35.156.26
country_id: 1210997
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/thumb.php?src=img/photos/3249053632.jpg&size=1000x1000 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 17:40:37 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:1126: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:40:58 dovecot_login authenticator failed for H=(mNjM0OnjH) [178.16.54.22]:55117: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.177.166
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=899701 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 17:41:29 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:57595: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:41:19 dovecot_login authenticator failed for H=(wsXoJ65L) [185.169.4.188]:56494: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:41:40 dovecot_login authenticator failed for H=(qxVqwSIL9e) [178.16.54.22]:60664: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2026-01-31 17:41:47 dovecot_login authenticator failed for H=([5.32.99.14]) [5.32.99.14]:45109: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.100.250.41
country_id: 2017370
description:
2026-01-31 17:42:45 dovecot_login authenticator failed for H=(93.100.250.41.pool.sknt.ru) [93.100.250.41]:51490: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-31 17:42:05 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:49397: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 17:42:23 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:64745: 535 Incorrect authentication data (set_id=test@symphony-led.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:42:11 dovecot_login authenticator failed for H=(k8mf6K6TeO) [185.169.4.188]:52529: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:42:24 dovecot_login authenticator failed for H=(LnHTi7h0F) [178.16.54.22]:51250: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/img/demos/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-31 17:42:22 H=([45.144.212.50]) [45.144.212.50]:62249 F=<ccmsservice@bangkokbank.com> rejected RCPT <celine@ktlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from bangkokbank.com


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 17:43:26 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent@a-connect.global has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:43:03 dovecot_login authenticator failed for H=(Mirt9yWI) [185.169.4.188]:65368: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
country_id: 6251999
description:
2026-01-31 17:43:05 dovecot_login authenticator failed for H=s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:63055: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:43:31 dovecot_login authenticator failed for H=(35qjsamzdb) [178.16.54.22]:59832: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.25.233.22
country_id: 1814991
description:
2026-01-31 17:43:58 dovecot_login authenticator failed for H=([218.25.233.2]) [218.25.233.22]:35165: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.22.253.229
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Examples/templates/31docproperties.xls HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.126.29
country_id: 3703430
description:
2026-01-31 17:43:18 dovecot_login authenticator failed for H=(ADMIN) [91.90.126.29]:56370: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.176.183
country_id: 1861060
domain: krisfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/class.php||SC:/home2/krisfood/public_html/images/class.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:44:03 dovecot_login authenticator failed for H=(FfIANJazx) [178.16.54.22]:55937: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:44:18 dovecot_login authenticator failed for H=(yUt4hsBX) [185.169.4.188]:51828: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 17:44:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent@a-connect.global has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.118
country_id: 1269750
description:
2026-01-31 17:44:21 dovecot_login authenticator failed for H=([128.185.243.163]) [182.95.119.118]:35310: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-01-31 17:44:46 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:41288: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.48.93.218
country_id: 1814991
description:
2026-01-31 17:44:10 dovecot_login authenticator failed for H=(218.93.48.59.broad.jz.sx.dynamic.163data.com.cn) [59.48.93.218]:47190: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
country_id: 2017370
description:
2026-01-31 17:45:01 dovecot_login authenticator failed for H=(dynamicip-95-79-108-51.pppoe.nn.ertelecom.ru) [95.79.108.51]:46165: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.62.103
country_id: 1814991
description:
2026-01-31 17:44:39 dovecot_login authenticator failed for H=([36.135.62.102]) [36.135.62.103]:43026: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.78.152.240
country_id: 1861060
domain: ajresorts.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/ajresortscom/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:45:12 dovecot_login authenticator failed for H=(p2m1gk) [185.169.4.188]:65328: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 17:45:12 H=([167.148.167.71]) [167.148.167.71]:55784 F=<Support@euratech.com.my> rejected RCPT <euratech@euratech.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.187
country_id: 1269750
description:
2026-01-31 17:45:13 dovecot_login authenticator failed for H=(nsg-corporate-187.230.187.122.airtel.in) [122.187.230.187]:37968: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.152.240
country_id: 1861060
domain: ajresorts.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/class.php||SC:/home2/ajresortscom/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
country_id: 1269750
description:
2026-01-31 17:45:02 dovecot_login authenticator failed for H=([103.55.89.5]) [116.75.218.103]:49302: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 17:45:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent@a-connect.global has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:45:27 dovecot_login authenticator failed for H=(fKa6jM2ZO) [178.16.54.22]:56484: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 17:46:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent@a-connect.global has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:46:04 dovecot_login authenticator failed for H=(zOIUmpN9P) [185.169.4.188]:54036: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:46:31 dovecot_login authenticator failed for H=(AaItBLx) [178.16.54.22]:56201: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2026-01-31 17:47:46 dovecot_login authenticator failed for H=([122.187.230.227]) [122.187.230.227]:50087: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:47:02 dovecot_login authenticator failed for H=(69L0WGTSd) [178.16.54.22]:49766: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-01-31 17:47:02 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:59936: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 17:47:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent@a-connect.global has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:47:22 dovecot_login authenticator failed for H=(qgVLix8l8z) [185.169.4.188]:62848: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.170.126
country_id: 1814991
description:
2026-01-31 17:47:33 dovecot_login authenticator failed for H=([220.180.170.126]) [220.180.170.126]:47327: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:48:09 dovecot_login authenticator failed for H=(HBZUhdhfU) [178.16.54.22]:49699: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.245
country_id: 1814991
description:
2026-01-31 17:48:12 dovecot_login authenticator failed for H=([111.61.176.245]) [111.61.176.245]:56644: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:48:17 dovecot_login authenticator failed for H=(lnOAo6u5) [185.169.4.188]:49681: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 17:49:01 dovecot_login authenticator failed for H=(3pxFqXw2) [185.230.124.69]:54000: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: lnlfireprotection.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home/lnlfireprotectio/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 17:49:09 dovecot_login authenticator failed for H=(7FTRosA) [185.230.124.69]:55818: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:49:08 dovecot_login authenticator failed for H=(o0Ik5jJy) [185.169.4.188]:53640: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:49:16 dovecot_login authenticator failed for H=(UvVQE6PkaA) [178.16.54.22]:62003: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.78.236.160
country_id: 1269750
domain: egbwawasan.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:59623.egbwawasan.com.my||ServerName:egbwawasan.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2c4fbee3a48063394870a1ba39883759d0c213b3||Title:0x2c682b6b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.22.116.94
country_id: 1269750
description:
2026-01-31 17:50:38 dovecot_login authenticator failed for H=([152.52.234.222]) [125.22.116.94]:37132: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.185.94
country_id: 1269750
description:
2026-01-31 17:50:55 dovecot_login authenticator failed for H=([125.18.28.146]) [125.17.185.94]:50021: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:50:03 dovecot_login authenticator failed for H=(Cq0ULqXQfh) [185.169.4.188]:53986: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 17:50:18 dovecot_login authenticator failed for H=(lqkzyd2HS) [185.230.124.69]:63361: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 17:51:51 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@figofoods.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.202.206.86
country_id: 1835841
description:
2026-01-31 17:51:59 dovecot_login authenticator failed for H=([119.202.206.86]) [119.202.206.86]:54010: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 17:51:15 dovecot_login authenticator failed for H=(AXeQFTb) [185.230.124.69]:61888: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:51:19 dovecot_login authenticator failed for H=(BenEFIGE) [185.169.4.188]:65090: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 17:52:50 dovecot_login authenticator failed for H=(4IQj7L7h) [185.230.124.69]:57677: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.92.124.2
country_id: 1269750
description:
2026-01-31 17:52:57 dovecot_login authenticator failed for H=(static.bb.ill.59.92.124.2.bsnl.in) [59.92.124.2]:54532: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 17:52:35 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent@a-connect.global has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 17:52:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@figofoods.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.143.69.79
country_id: 2750405
description:
2026-01-31 17:52:50 dovecot_login authenticator failed for H=([108.143.69.79]) [108.143.69.79]:33530: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.252.168.4
country_id: 1269750
description:
2026-01-31 17:52:56 dovecot_login authenticator failed for H=a4.ucndns.in [103.252.168.4]:53952: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 17:52:12 dovecot_login authenticator failed for H=(oJlfJrJKw) [185.230.124.69]:53458: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.242.142
country_id: 1269750
description:
2026-01-31 17:52:18 dovecot_login authenticator failed for H=([125.19.172.137]) [182.78.242.142]:33866: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:52:09 dovecot_login authenticator failed for H=(8zmIcDY1) [185.169.4.188]:64948: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 17:53:27 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent@a-connect.global has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.26.90.10
country_id: 1814991
description:
2026-01-31 17:53:38 dovecot_login authenticator failed for H=([1.26.90.10]) [1.26.90.10]:42418: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:53:03 dovecot_login authenticator failed for H=(OxxTht0N) [185.169.4.188]:49961: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 17:53:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@figofoods.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 17:53:09 dovecot_login authenticator failed for H=(jArAPOpzAC) [185.230.124.69]:59770: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2026-01-31 17:53:27 dovecot_login authenticator failed for H=([103.56.85.65]) [128.185.227.166]:55920: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 17:54:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent@a-connect.global has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:54:20 dovecot_login authenticator failed for H=(yGatkYw) [185.169.4.188]:58819: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2026-01-31 17:55:02 dovecot_login authenticator failed for H=69-172-79-198.static.imsbiz.com ([173.248.234.145]) [69.172.79.198]:61607: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 17:54:40 H=([167.148.167.71]) [167.148.167.71]:54236 F=<Support@aire-fresh.com> rejected RCPT <francis@aire-fresh.com>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2026-01-31 17:54:44 dovecot_login authenticator failed for H=([70.120.1.74]) [70.120.1.74]:60151: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-31 17:54:58 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:56102: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 17:54:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@figofoods.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 17:54:06 dovecot_login authenticator failed for H=(egtVyhan) [185.230.124.69]:51391: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 17:55:03 dovecot_login authenticator failed for H=(1W86uA) [185.230.124.69]:54487: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 17:55:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent@a-connect.global has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:55:11 dovecot_login authenticator failed for H=(jJ0jZP) [185.169.4.188]:59037: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 17:55:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@figofoods.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 17:55:28 dovecot_login authenticator failed for H=(zgN7nAZUAp) [2.58.56.77]:53277: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/commercial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 17:56:15 dovecot_login authenticator failed for H=(wX9NIHz) [2.58.56.77]:50784: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 17:56:19 dovecot_login authenticator failed for H=(A4m9MxF) [185.230.124.69]:54530: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.175.75
country_id: 99237
description:
2026-01-31 17:56:55 dovecot_login authenticator failed for H=([65.20.175.75]) [65.20.175.75]:52299: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 13.75.54.243
country_id: 1819730
domain: zrrtc.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/dpscomsec/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 17:56:00 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent@a-connect.global has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 17:56:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@figofoods.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.71.84.38
country_id: 3469034
description:
2026-01-31 17:56:34 dovecot_login authenticator failed for H=([200.71.84.38]) [200.71.84.38]:38870: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: zrrtc.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/class.php||SC:/home2/dpscomsec/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:56:02 dovecot_login authenticator failed for H=(czNzBmbfZ) [185.169.4.188]:59569: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.149.161.131
country_id: 6252001
description:
2026-01-31 17:57:32 dovecot_login authenticator failed for H=c-50-149-161-131.hsd1.tn.comcast.net [50.149.161.131]:65368: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.84.209.188
country_id: 1814991
description:
2026-01-31 17:57:46 dovecot_login authenticator failed for H=([117.40.175.86]) [223.84.209.188]:33814: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 17:57:22 dovecot_login authenticator failed for H=(FLEnw0d) [2.58.56.77]:65234: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-01-31 17:57:48 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:46278: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:57:19 dovecot_login authenticator failed for H=(H0v1ktU) [185.169.4.188]:51520: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2026-01-31 17:57:39 dovecot_login authenticator failed for H=(228.pool90-161-217.static.orange.es) [90.161.217.228]:39667: 535 Incorrect authentication data


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 17:57:16 dovecot_login authenticator failed for H=(YJlhzG0) [185.230.124.69]:51287: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 17:57:35 dovecot_login authenticator failed for H=(eO29YLh) [185.230.124.69]:50969: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.81.15.4
country_id: 3469034
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/press-details.php?id=107240 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2026-01-31 17:58:48 dovecot_login authenticator failed for H=([218.149.235.152]) [218.149.235.152]:56936: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 17:58:50 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:58:09 dovecot_login authenticator failed for H=(WcmgLY20) [185.169.4.188]:51638: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.185.110.32
country_id: 2623032
description:
2026-01-31 17:58:26 dovecot_login authenticator failed for H=x5ab96e20.customers.hiper-net.dk [90.185.110.32]:32777: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 17:58:07 dovecot_login authenticator failed for H=(pYFSG6) [2.58.56.77]:59270: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2026-01-31 17:58:18 dovecot_login authenticator failed for H=([65.20.211.96]) [65.20.211.96]:60010: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 17:58:13 dovecot_login authenticator failed for H=(OfWsCTlCnv) [185.230.124.69]:56310: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 17:59:02 dovecot_login authenticator failed for H=(Euiuuv) [185.169.4.188]:51976: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.21.209.27
country_id: 1814991
description:
2026-01-31 17:59:05 dovecot_login authenticator failed for H=([60.21.209.27]) [60.21.209.27]:50327: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.55.16
country_id: 3144096
description:
2026-01-31 17:59:13 dovecot_login authenticator failed for H=(cm-178.232.55.16.get.no) [178.232.55.16]:32896: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 17:59:10 dovecot_login authenticator failed for H=(XbNLBPR) [185.230.124.69]:52248: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 17:59:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 17:59:14 dovecot_login authenticator failed for H=(p3VvNavOB) [2.58.56.77]:56291: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 17:59:46 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@figofoods.com.my has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:47356.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3324cadccaea6def08b5e009a72246ebee383a97||Title:0xdd18fa75||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:00:06 dovecot_login authenticator failed for H=(Z90SfPoQIA) [185.230.124.69]:57690: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:00:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:00:19 dovecot_login authenticator failed for H=(y7KCkWd) [185.169.4.188]:61228: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2026-01-31 18:00:37 dovecot_login authenticator failed for H=([221.209.48.204]) [221.209.48.203]:36566: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:00:25 dovecot_login authenticator failed for H=(7FqTUi2M) [185.230.124.69]:62094: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-31 18:00:03 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:50907: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:00:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@figofoods.com.my has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.83.174.116
country_id: 1168579
domain: empirelog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:37841.empirelog.com.my||ServerName:empirelog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:acdc98eb74f40c9651ce8a63c5a8f8fa73995949||Title:0x2c25e47c||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:00:18 dovecot_login authenticator failed for H=(mGDMXRQ5) [2.58.56.77]:65413: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/photos/index.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:01:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@figofoods.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.108
country_id: 1814991
description:
2026-01-31 18:01:34 dovecot_login authenticator failed for H=([111.61.97.108]) [111.61.97.108]:21280: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:01:02 dovecot_login authenticator failed for H=(39AGJ1pY) [185.230.124.69]:53658: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2026-01-31 18:01:06 dovecot_login authenticator failed for H=([122.187.230.227]) [122.187.230.227]:52941: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:01:12 dovecot_login authenticator failed for H=(QdZEoGYd4z) [185.169.4.188]:62201: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 18:01:35 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent@a-connect.global has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.73.24
country_id: 1668284
description:
2026-01-31 18:01:51 dovecot_login authenticator failed for H=221-120-73-24.emome-ip.hinet.net [221.120.73.24]:58424: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:01:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:01:03 dovecot_login authenticator failed for H=(Tcf0ethNHH) [2.58.56.77]:52997: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: euratech.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/euratechcom/public_html/images||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:02:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:02:37 dovecot_login authenticator failed for H=(nujU835) [185.230.124.69]:50965: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:02:10 dovecot_login authenticator failed for H=(P8GMfYKK) [185.230.124.69]:64484: 535 Incorrect authentication data (set_id=enquiry@cabe.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:02:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@figofoods.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.63.34.149
country_id: 1835841
description:
2026-01-31 18:03:01 dovecot_login authenticator failed for H=([211.63.34.149]) [211.63.34.149]:35122: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 18:02:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent@a-connect.global has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 18:02:10 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:57220: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:02:03 dovecot_login authenticator failed for H=(7dJBySK3) [185.169.4.188]:63077: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.228.134
country_id: 1269750
description:
2026-01-31 18:02:04 dovecot_login authenticator failed for H=(nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:49994: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:02:09 dovecot_login authenticator failed for H=(DKBeTVt2) [2.58.56.77]:64995: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-31 18:02:48 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:35417: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2026-01-31 18:03:12 dovecot_login authenticator failed for H=(nsg-corporate-113.199.185.122.airtel.in) [122.186.202.58]:49734: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:03:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:03:11 dovecot_login authenticator failed for H=(zumjvcV) [2.58.56.77]:62822: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:03:17 dovecot_login authenticator failed for H=(9Kh81Y) [185.169.4.188]:55201: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-31 18:03:22 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:40337: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:03:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@cabe.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:03:07 dovecot_login authenticator failed for H=(nEp1Qtqp) [185.230.124.69]:61619: 535 Incorrect authentication data (set_id=enquiry@cabe.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 18:03:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent@a-connect.global has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 18:04:39 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:60261: 535 Incorrect authentication data (set_id=test@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:04:50 dovecot_login authenticator failed for H=(91Dnh6wgs) [185.230.124.69]:52685: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:04:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@cabe.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:04:04 dovecot_login authenticator failed for H=(q3V3g9) [185.230.124.69]:63982: 535 Incorrect authentication data (set_id=enquiry@cabe.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.255.50
country_id: 1269750
description:
2026-01-31 18:04:18 dovecot_login authenticator failed for H=([182.95.203.81]) [122.186.255.50]:55544: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.85.69.22
country_id: 2017370
description:
2026-01-31 18:04:29 dovecot_login authenticator failed for H=(22.69.85.194.in-addr.arpa) [194.85.69.22]:54818: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-01-31 18:04:56 dovecot_login authenticator failed for H=([175.180.129.87]) [175.180.129.87]:48662: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:04:05 dovecot_login authenticator failed for H=(8S2WybE) [185.169.4.188]:55791: 535 Incorrect authentication data (set_id=vincent@a-connect.global)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:04:19 dovecot_login authenticator failed for H=(diwafy5jpp) [2.58.56.77]:50946: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/languages/images/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.10.20
country_id: 1814991
description:
2026-01-31 18:04:45 dovecot_login authenticator failed for H=([221.10.10.20]) [221.10.10.20]:45060: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:04:30 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:50398: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 18:04:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent@a-connect.global has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-01-31 18:05:17 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:43698: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:05:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@cabe.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:05:05 dovecot_login authenticator failed for H=(QH4UldJP) [2.58.56.77]:58851: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:05:09 dovecot_login authenticator failed for H=(VhaCmEEeoO) [185.230.124.69]:59659: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:05:17 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:61347: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-01-31 18:05:34 dovecot_login authenticator failed for H=([85.19.195.12]) [85.19.195.12]:45814: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:05:19 dovecot_login authenticator failed for H=(3V19TKGr) [185.169.4.188]:64152: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:06:10 dovecot_login authenticator failed for H=(bZUtuhxT) [185.169.4.188]:64603: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:06:12 dovecot_login authenticator failed for H=(sTxcyVEE) [2.58.56.77]:63615: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 18:06:03 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:62378: 535 Incorrect authentication data (set_id=test@wcc.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:06:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@cabe.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:06:57 dovecot_login authenticator failed for H=(kVTRqf04) [91.92.240.235]:57138: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:06:06 dovecot_login authenticator failed for H=(Wpk9kU) [185.230.124.69]:59460: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:07:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:07:14 dovecot_login authenticator failed for H=(PYWY05VCcf) [2.58.56.77]:55041: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:07:21 dovecot_login authenticator failed for H=(Abg3N8n) [91.92.240.235]:57739: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.234.36
country_id: 289688
description:
2026-01-31 18:07:06 dovecot_login authenticator failed for H=(ADMIN) [95.181.234.36]:5073: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 18:07:12 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:54405: 535 Incorrect authentication data (set_id=test@chs.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:07:03 dovecot_login authenticator failed for H=(8hvXlA) [185.230.124.69]:59593: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:07:14 dovecot_login authenticator failed for H=(uxMLmk) [185.230.124.69]:50795: 535 Incorrect authentication data (set_id=enquiry@cabe.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:07:24 dovecot_login authenticator failed for H=(uDapDC3JXM) [185.169.4.188]:57749: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.39.82
country_id: 1814991
description:
2026-01-31 18:08:05 dovecot_login authenticator failed for H=([60.174.39.82]) [60.174.39.82]:56113: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.92.129.37
country_id: 6252001
description:
[2026-01-31 18:08:22 +0800] info [cpaneld] 99.92.129.37 - tsch "GET /login/?login_only=1&user=tsch&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tsch (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.182.245.30
country_id: 6252001
description:
[2026-01-31 18:08:11 +0800] info [cpaneld] 97.182.245.30 - tschuancom "GET /login/?login_only=1&user=tschuancom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tschuancom (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:08:16 dovecot_login authenticator failed for H=(v4ak208RH) [185.169.4.188]:58015: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.71.196.104
country_id: 6252001
description:
[2026-01-31 18:08:25 +0800] info [cpaneld] 173.71.196.104 - tsc "GET /login/?login_only=1&user=tsc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tsc (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.189
country_id: 1814991
description:
2026-01-31 18:08:33 dovecot_login authenticator failed for H=([111.61.177.189]) [111.61.177.189]:47940: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:08:11 dovecot_login authenticator failed for H=(zbueJfi) [185.230.124.69]:64470: 535 Incorrect authentication data (set_id=enquiry@cabe.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.86.19.11
country_id: 6252001
description:
[2026-01-31 18:08:14 +0800] info [cpaneld] 152.86.19.11 - tschua "GET /login/?login_only=1&user=tschua&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tschua (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.239.19.87
country_id: 2017370
description:
2026-01-31 18:08:28 dovecot_login authenticator failed for H=([195.239.19.87]) [195.239.19.87]:55386: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.132.135.140
country_id: 6252001
description:
[2026-01-31 18:08:04 +0800] info [cpaneld] 47.132.135.140 - tschuan "GET /login/?login_only=1&user=tschuan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.184.231.176
country_id: 6252001
description:
[2026-01-31 18:08:28 +0800] info [cpaneld] 76.184.231.176 - ts "GET /login/?login_only=1&user=ts&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ts (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:08:10 dovecot_login authenticator failed for H=(99PNHZxomp) [91.92.240.235]:60882: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.177.228
country_id: 1269750
description:
2026-01-31 18:08:48 dovecot_login authenticator failed for H=([111.93.177.228]) [111.93.177.228]:57294: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:08:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:08:21 dovecot_login authenticator failed for H=(Vz2GkUZd1) [2.58.56.77]:64320: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.178.203.226
country_id: 6252001
description:
2026-01-31 18:08:50 dovecot_login authenticator failed for H=pool-71-178-203-226.washdc.fios.verizon.net [71.178.203.226]:57638: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.92.232.8
country_id: 6252001
description:
[2026-01-31 18:08:16 +0800] info [cpaneld] 69.92.232.8 - tschu "GET /login/?login_only=1&user=tschu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tschu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.27.231.134
country_id: 6252001
description:
[2026-01-31 18:08:06 +0800] info [cpaneld] 45.27.231.134 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:09:16 dovecot_login authenticator failed for H=(d2mHb9nFq) [185.230.124.69]:53423: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.164.93.136
country_id: 6252001
description:
2026-01-31 18:09:49 dovecot_login authenticator failed for H=(syn-024-164-093-136.res.spectrum.com) [24.164.93.136]:42701: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 18:09:51 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:62775: 535 Incorrect authentication data (set_id=test@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:09:04 dovecot_login authenticator failed for H=(RpXhgbba) [2.58.56.77]:50447: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 18:09:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:09:10 dovecot_login authenticator failed for H=(vdwBdn0) [185.169.4.188]:58823: 535 Incorrect authentication data (set_id=vincent)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: stealthvenom.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/content.php||SC:/home2/cabecom/public_html/wp-content||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:09:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:09:23 dovecot_login authenticator failed for H=(IgpNlK) [91.92.240.235]:63773: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:09:29 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:58575: 535 Incorrect authentication data (set_id=test@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.216.89.122
country_id: 1814991
description:
2026-01-31 18:09:23 dovecot_login authenticator failed for H=([60.216.89.122]) [60.216.89.122]:46864: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.246.43
country_id: 1814991
description:
2026-01-31 18:09:07 dovecot_login authenticator failed for H=([220.178.246.43]) [220.178.246.43]:48917: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: tptec.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home/tptecadmin/public_html/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:09:08 dovecot_login authenticator failed for H=(xf0a8aJh) [185.230.124.69]:54013: 535 Incorrect authentication data (set_id=enquiry@cabe.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.172.98
country_id: 1269750
description:
2026-01-31 18:11:01 dovecot_login authenticator failed for H=([27.123.119.146]) [122.187.172.98]:38794: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.30.170
country_id: 1814991
description:
2026-01-31 18:10:05 dovecot_login authenticator failed for H=([61.185.30.170]) [61.185.30.170]:47400: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:10:13 dovecot_login authenticator failed for H=(2Gu198) [2.58.56.77]:60137: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.187.231.185
country_id: 953987
description:
2026-01-31 18:10:15 dovecot_login authenticator failed for H=([41.149.42.161]) [105.187.231.185]:57875: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:10:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@cabe.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:10:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:10:12 dovecot_login authenticator failed for H=(UTUYYFhZx) [91.92.240.235]:57010: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-31 18:10:53 H=([45.144.212.50]) [45.144.212.50]:62757 F=<ccmsservice@bangkokbank.com> rejected RCPT <mustapa@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from bangkokbank.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:10:05 dovecot_login authenticator failed for H=(YT5Kaz) [185.230.124.69]:59164: 535 Incorrect authentication data (set_id=enquiry@cabe.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:10:12 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:64587: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 18:10:26 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:10:28 dovecot_login authenticator failed for H=(ovTzLSurQ) [185.169.4.188]:52770: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.39.216
country_id: 1668284
description:
2026-01-31 18:10:57 dovecot_login authenticator failed for H=111-70-39-216.emome-ip.hinet.net [111.70.39.216]:41247: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:11:21 dovecot_login authenticator failed for H=(VifL4Qlu) [185.169.4.188]:51728: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-31 18:11:57 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:51055: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:11:06 dovecot_login authenticator failed for H=(Ent0sna) [91.92.240.235]:50111: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:11:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:11:20 dovecot_login authenticator failed for H=(m4xaQs) [2.58.56.77]:53064: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.2
country_id: 1149361
description:
2026-01-31 18:11:20 dovecot_login authenticator failed for H=([149.54.62.2]) [149.54.62.2]:48803: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:11:02 dovecot_login authenticator failed for H=(NafGPn4) [185.230.124.69]:63806: 535 Incorrect authentication data (set_id=enquiry@cabe.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:11:03 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:63018: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:11:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:11:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:11:21 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:53156: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 18:11:15 H=([167.148.167.71]) [167.148.167.71]:63258 F=<Support@hmz.com.my> rejected RCPT <hr@hmz.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.101
country_id: 6251999
description:
2026-01-31 18:11:58 dovecot_login authenticator failed for H=([207.219.221.101]) [207.219.221.101]:56222: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 18:11:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.246.31.172
country_id: 1814991
description:
2026-01-31 18:11:50 dovecot_login authenticator failed for H=([116.246.31.172]) [116.246.31.172]:55258: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.242
country_id: 1814991
description:
2026-01-31 18:12:15 dovecot_login authenticator failed for H=([111.61.176.242]) [111.61.176.242]:59652: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:12:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:12:13 dovecot_login authenticator failed for H=(AfgV6q7hP) [185.169.4.188]:51121: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:12:14 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:51401: 535 Incorrect authentication data (set_id=testing@aircarbonic.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.169.24
country_id: 1861060
domain: egbwawasan.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/egbwawasancom/public_html/images||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:12:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:12:21 dovecot_login authenticator failed for H=(HLmJMQA) [2.58.56.77]:56166: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.123.109.43
country_id: 732800
description:
2026-01-31 18:12:23 dovecot_login authenticator failed for H=(ADMIN) [93.123.109.43]:45502: 535 Incorrect authentication data (set_id=jaya@ds-staffing.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 18:12:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:12:07 dovecot_login authenticator failed for H=(sXjR4FoY6) [185.230.124.69]:54776: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:12:21 dovecot_login authenticator failed for H=(pkKW6h1zF) [91.92.240.235]:58043: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:13:04 dovecot_login authenticator failed for H=(QxivDm) [185.230.124.69]:57159: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.75
country_id: 1269750
description:
2026-01-31 18:13:22 dovecot_login authenticator failed for H=([203.193.147.75]) [203.193.147.75]:39562: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:13:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 18:13:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:13:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:13:13 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:61714: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-01-31 18:13:28 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:48678: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.61.199.212
country_id: 6252001
description:
2026-01-31 18:13:07 dovecot_plain authenticator failed for H=c-24-61-199-212.hsd1.ct.comcast.net (tuorate) [24.61.199.212]:58074: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:13:24 dovecot_login authenticator failed for H=(0OTZujv) [2.58.56.77]:64015: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:13:05 dovecot_login authenticator failed for H=(cK0D9naj) [185.169.4.188]:55275: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:13:11 dovecot_login authenticator failed for H=(enkTjrgHo) [91.92.240.235]:63077: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:13:34 dovecot_login authenticator failed for H=(zhIVnMo) [185.230.124.69]:63264: 535 Incorrect authentication data (set_id=enquiry@cabe.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-31 18:13:44 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:44679: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:14:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@cabe.com.my has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.170.231.173
country_id: 1210997
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=27331514528878 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-31 18:14:53 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:53191: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:14:26 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.5.153.106
country_id: 1562822
description:
2026-01-31 18:14:04 dovecot_plain authenticator failed for H=(6MB1PQ8V7O8RZW8) [117.5.153.106]:34443: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:14:03 dovecot_login authenticator failed for H=(zZQLYZu) [91.92.240.235]:52766: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:14:08 dovecot_login authenticator failed for H=(B9RqKb) [2.58.56.77]:55912: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:14:12 dovecot_login authenticator failed for H=(5WuUaU4) [185.230.124.69]:62321: 535 Incorrect authentication data (set_id=enquiry@cabe.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:14:17 dovecot_login authenticator failed for H=(xHCTX4bU) [185.169.4.188]:59298: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:15:47 dovecot_login authenticator failed for H=(7lenKebAZ6) [185.230.124.69]:49591: 535 Incorrect authentication data (set_id=enquiry@cabe.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:15:15 dovecot_login authenticator failed for H=(iD55bV) [2.58.56.77]:50356: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:15:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-01-31 18:15:26 47144 [Warning] Aborted connection 47144 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:15:07 dovecot_login authenticator failed for H=(YbAZX5Zg) [185.169.4.188]:60236: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:15:17 dovecot_login authenticator failed for H=(v1RxGKRK3) [91.92.240.235]:61306: 535 Incorrect authentication data (set_id=cky)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/demos/img/img/new-development.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-01-31 18:15:19 dovecot_login authenticator failed for H=([175.180.129.87]) [175.180.129.87]:36294: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:15:34 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-01-31 18:16:01 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:46560: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-01-31 18:15:03 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:54732: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:15:09 dovecot_login authenticator failed for H=(EJ2cUxqanz) [185.230.124.69]:52024: 535 Incorrect authentication data (set_id=enquiry@cabe.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:15:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-31 18:15:16 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:59179: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.187
country_id: 1814991
description:
2026-01-31 18:15:47 dovecot_login authenticator failed for H=([111.61.177.187]) [111.61.177.187]:34622: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.202.201
country_id: 51537
description:
2026-01-31 18:15:58 dovecot_login authenticator failed for H=([197.231.202.201]) [197.231.202.201]:38828: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.87
country_id: 1269750
description:
2026-01-31 18:16:52 dovecot_login authenticator failed for H=(nsg-corporate-87.229.187.122.airtel.in) [122.187.229.87]:46024: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:16:06 dovecot_login authenticator failed for H=(94b4EIsC) [185.230.124.69]:57477: 535 Incorrect authentication data (set_id=enquiry@cabe.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-01-31 18:16:07 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:10970: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.174.104.74
country_id: 2017370
description:
2026-01-31 18:16:15 dovecot_login authenticator failed for H=(host-109-174-104-74.bb-nsk.sib.mts.ru) [109.174.104.74]:55916: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:16:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/demos/img/img/index.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2026-01-31 18:16:54 dovecot_login authenticator failed for H=([122.187.230.227]) [122.187.230.227]:34550: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:16:07 dovecot_login authenticator failed for H=(pwsVJcNQbC) [91.92.240.235]:55303: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:16:21 dovecot_login authenticator failed for H=(gPhI1E6) [185.169.4.188]:57339: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:16:22 dovecot_login authenticator failed for H=(jDeGBwzVkX) [2.58.56.77]:51963: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-31 18:16:55 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:53663: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:17:20 dovecot_login authenticator failed for H=(9c72VG3bWF) [91.92.240.235]:53448: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:17:59 dovecot_login authenticator failed for H=(0k1a6ws) [185.230.124.69]:61649: 535 Incorrect authentication data (set_id=enquiry@cabe.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-01-31 18:17:03 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:33252: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:17:10 dovecot_login authenticator failed for H=(qptUFd0a) [2.58.56.77]:50209: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-01-31 18:17:32 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:58014: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 18:17:56 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:17:09 dovecot_login authenticator failed for H=(raBPVZ) [185.169.4.188]:56611: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:17:12 dovecot_login authenticator failed for H=(baeBJoa) [185.230.124.69]:58265: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-31 18:17:15 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:35321: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 18:17:34 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:20400: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-31 18:17:42 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:50903: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:18:03 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:59347: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:18:15 dovecot_login authenticator failed for H=(dfEopvIF) [2.58.56.77]:65473: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:18:22 dovecot_login authenticator failed for H=(omDpAOoG) [185.169.4.188]:57136: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.219
country_id: 798544
description:
2026-01-31 18:18:06 dovecot_login authenticator failed for H=89-67-37-219.dynamic.play.pl [89.67.37.219]:51745: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.244
country_id: 1814991
description:
2026-01-31 18:18:09 dovecot_login authenticator failed for H=([111.61.176.244]) [111.61.176.244]:13360: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.18
country_id: 1269750
description:
2026-01-31 18:18:44 dovecot_login authenticator failed for H=([125.17.10.161]) [182.95.58.18]:44234: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:18:45 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:18:11 dovecot_login authenticator failed for H=(ns6mIS) [91.92.240.235]:50754: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:18:09 dovecot_login authenticator failed for H=(NBV8CPejAH) [185.230.124.69]:62038: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2026-01-31 18:18:47 dovecot_login authenticator failed for H=15-50-166-83.dyn.estpak.ee [83.166.50.15]:56835: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 18:18:28 H=([167.148.167.71]) [167.148.167.71]:60077 F=<Support@indfinitydesign.com> rejected RCPT <ind@indfinitydesign.com>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2026-01-31 18:18:15 dovecot_login authenticator failed for H=([103.50.5.94]) [103.50.5.94]:35501: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 18:18:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.61.40.117
country_id: 3469034
description:
2026-01-31 18:18:54 dovecot_login authenticator failed for H=201-61-40-117.bbone.telesp.net.br (189-44-180-233.customer.tdatabrasil.net.br) [201.61.40.117]:43570: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.134.120
country_id: 1269750
description:
2026-01-31 18:19:14 dovecot_login authenticator failed for H=(abts-mum-static-120.134.179.122.airtelbroadband.in) [122.179.134.120]:54050: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
country_id: 2017370
description:
2026-01-31 18:19:22 dovecot_login authenticator failed for H=(dynamicip-95-79-108-51.pppoe.nn.ertelecom.ru) [95.79.108.51]:58503: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:19:23 dovecot_login authenticator failed for H=(TvQF1wXet) [91.92.240.235]:54198: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:19:46 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.4.156.254
country_id: 1814991
description:
2026-01-31 18:19:03 dovecot_login authenticator failed for H=mail.toptronicsinc.com [218.4.156.254]:38112: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:19:08 dovecot_login authenticator failed for H=(cxLnuB) [185.169.4.188]:55204: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.165
country_id: 1835841
description:
2026-01-31 18:19:11 dovecot_login authenticator failed for H=([121.142.146.165]) [121.142.146.165]:32870: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2026-01-31 18:19:57 dovecot_login authenticator failed for H=([50.223.176.171]) [50.223.176.171]:48224: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:19:04 dovecot_login authenticator failed for H=(cvtQ6LRdF) [2.58.56.77]:65020: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:19:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:19:06 dovecot_login authenticator failed for H=(rTOBlM) [185.230.124.69]:59084: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 18:19:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:20:03 dovecot_login authenticator failed for H=(ceAwe8) [185.230.124.69]:57216: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:20:14 dovecot_login authenticator failed for H=(VqXNEm16) [91.92.240.235]:64355: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:20:53 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:20:21 dovecot_login authenticator failed for H=(9JZzPo) [185.169.4.188]:58451: 535 Incorrect authentication data (set_id=vincent)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.126.36.5
country_id: 1210997
domain: euratech.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:11506.euratech.com.my||ServerName:euratech.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2b32ac2d25618bdd9a54abd65d1d40ca4a04e8dc||Title:0xe61bf3e1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:20:11 dovecot_login authenticator failed for H=(uAELglwY4W) [2.58.56.77]:52963: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:20:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 18:20:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent has been locked for the attacker IP 185.169.4.188


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.253.100.67
country_id: 1269750
domain: euratech.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:60019.euratech.com.my||ServerName:euratech.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7e4ddbd078d662b415e140778a87daaa7eff0e8c||Title:0xdcd68d74||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:20:25 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:52220: 535 Incorrect authentication data (set_id=test@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.229.42
country_id: 1269750
description:
2026-01-31 18:20:06 dovecot_login authenticator failed for H=([152.52.238.53]) [152.52.229.42]:44098: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:20:12 dovecot_login authenticator failed for H=(mXRPaGk) [185.230.124.69]:51087: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:20:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:21:09 dovecot_login authenticator failed for H=(dSQcKyESu) [185.230.124.69]:59089: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.227.63.227
country_id: 2921044
description:
2026-01-31 18:21:40 dovecot_plain authenticator failed for H=([212.227.63.227]) [212.227.63.227]:57514: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:21:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:21:26 dovecot_login authenticator failed for H=(dqAKVXZmi) [91.92.240.235]:57605: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.215.41.63
country_id: 357994
description:
2026-01-31 18:21:03 dovecot_plain authenticator failed for H=(6MB1PQ8V7O8RZW8) [156.215.41.63]:64627: 535 Incorrect authentication data (set_id=norhayati.ab-samad@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:21:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:21:53 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:53916: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 18:21:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:21:07 dovecot_login authenticator failed for H=(3vIDIRrPV) [185.169.4.188]:64316: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:21:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:21:21 dovecot_login authenticator failed for H=(NM2phFi) [2.58.56.77]:55849: 535 Incorrect authentication data (set_id=spyong)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.111.228.75
country_id: 1210997
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/index.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:22:10 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:60734: 535 Incorrect authentication data (set_id=testing@symphony-led.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:22:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:22:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:22:06 dovecot_login authenticator failed for H=(iFh7ti) [185.230.124.69]:50843: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:22:20 dovecot_login authenticator failed for H=(bLYofUEL2) [185.169.4.188]:56488: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:22:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:22:25 dovecot_login authenticator failed for H=(2dfbbT4e) [185.230.124.69]:55584: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.132.164.25
country_id: 2635167
description:
2026-01-31 18:23:00 dovecot_login authenticator failed for H=(ADMIN) [23.132.164.25]:51385: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:22:04 dovecot_login authenticator failed for H=(WGtUr5KSr) [2.58.56.77]:49442: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:22:15 dovecot_login authenticator failed for H=(Ik8uJFTd) [91.92.240.235]:64409: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 18:22:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:23:45 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:62313: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.182
country_id: 1668284
description:
2026-01-31 18:23:12 dovecot_login authenticator failed for H=111-70-49-182.emome-ip.hinet.net [111.70.49.182]:37846: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:23:09 dovecot_login authenticator failed for H=(ooJLgZyl) [185.169.4.188]:56031: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:23:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:23:12 dovecot_login authenticator failed for H=(6UjJV7tt) [2.58.56.77]:62885: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2026-01-31 18:23:53 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:38940: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:23:03 dovecot_login authenticator failed for H=(MyASIg0) [185.230.124.69]:50042: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:23:05 dovecot_login authenticator failed for H=(OMcxz2) [91.92.240.235]:58331: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.107.242.43
country_id: 248816
description:
2026-01-31 18:23:24 dovecot_plain authenticator failed for H=(E7G74M1Q) [109.107.242.43]:55663: 535 Incorrect authentication data (set_id=premalata@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:23:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:23:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:24:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:24:19 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:55523: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:24:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:24:23 dovecot_login authenticator failed for H=(WlZ4ufHfvK) [185.169.4.188]:63534: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.161.232.9
country_id: 6252001
description:
2026-01-31 18:24:09 dovecot_login authenticator failed for H=ip98-161-232-9.ph.ph.cox.net [98.161.232.9]:38572: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:24:10 dovecot_login authenticator failed for H=(tCZ4jbRI4) [185.230.124.69]:58087: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:24:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:24:18 dovecot_login authenticator failed for H=(RgP9HhM4) [91.92.240.235]:63518: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:24:24 dovecot_login authenticator failed for H=(QUBVDzOPdZ) [2.58.56.77]:60151: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.79.112
country_id: 1814991
description:
2026-01-31 18:24:26 dovecot_login authenticator failed for H=([111.26.79.112]) [111.26.79.112]:57896: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:24:38 dovecot_login authenticator failed for H=(Psn5CEQyf) [185.230.124.69]:63421: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:25:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:25:08 dovecot_login authenticator failed for H=(JM87Mc) [91.92.240.235]:62193: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:25:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:25:06 dovecot_login authenticator failed for H=(Ndyvo7) [2.58.56.77]:62899: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:25:07 dovecot_login authenticator failed for H=(2GdfBrhIk) [185.230.124.69]:57241: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:25:10 dovecot_login authenticator failed for H=(mjCext) [185.169.4.188]:63392: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.105.11
country_id: 3469034
description:
2026-01-31 18:26:20 dovecot_login authenticator failed for H=(faculdadeunica.static.gvt.net.br) [177.43.105.11]:47768: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:26:21 dovecot_login authenticator failed for H=(z4R7JaH) [185.169.4.188]:53248: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:26:24 dovecot_login authenticator failed for H=(uUoxCI7bBr) [91.92.240.235]:52402: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.19.165.90
country_id: 3469034
description:
2026-01-31 18:26:39 dovecot_login authenticator failed for H=(secovi-rs.pae.gvt.net.br) [177.19.165.90]:46109: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 18:26:43 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.21.209.27
country_id: 1814991
description:
2026-01-31 18:26:59 dovecot_login authenticator failed for H=([60.21.209.27]) [60.21.209.27]:65149: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:26:04 dovecot_login authenticator failed for H=(rDtgWGJ26) [185.230.124.69]:63025: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:26:17 dovecot_login authenticator failed for H=(Kgm9MBOh) [2.58.56.77]:61536: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.154.34.130
country_id: 298795
description:
2026-01-31 18:27:13 dovecot_login authenticator failed for H=(server.keyubu.com) [94.154.34.130]:60562: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 18:27:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:27:30 dovecot_login authenticator failed for H=(b0FiQz) [185.230.124.69]:50310: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:27:06 dovecot_login authenticator failed for H=(R5ZQyD) [2.58.56.77]:51306: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:27:11 dovecot_login authenticator failed for H=(VvrP91q) [185.169.4.188]:51285: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 18:27:23 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:56493: 535 Incorrect authentication data (set_id=test@mams1.manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:27:10 dovecot_login authenticator failed for H=(zHnizZI5) [185.230.124.69]:56778: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:27:14 dovecot_login authenticator failed for H=(WqzWM0VP) [91.92.240.235]:59407: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:28:05 dovecot_login authenticator failed for H=(N3zNCHB) [91.92.240.235]:60852: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:28:09 dovecot_login authenticator failed for H=(6OKSx7th) [185.230.124.69]:49572: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 18:28:10 dovecot_login authenticator failed for H=(2dkYeEiOL) [69.5.189.21]:59414: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:28:10 dovecot_login authenticator failed for H=(r2mK4aJpkX) [2.58.56.77]:64030: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 18:28:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:28:21 dovecot_login authenticator failed for H=(pArgBvIYw) [185.169.4.188]:60884: 535 Incorrect authentication data (set_id=vincent)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.186.77.66
country_id: 1562822
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/smart.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:29:22 dovecot_login authenticator failed for H=(2uLFFH) [2.58.56.77]:51381: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:29:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:29:38 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:53242: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:29:43 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.117
country_id: 1814991
description:
2026-01-31 18:29:55 dovecot_login authenticator failed for H=([111.61.175.117]) [111.61.175.117]:31370: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 18:29:11 dovecot_login authenticator failed for H=(qxMYLYi) [185.169.4.188]:61383: 535 Incorrect authentication data (set_id=vincent)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 18:29:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account vincent has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 18:29:21 dovecot_login authenticator failed for H=(BejHdRa8e) [69.5.189.21]:54746: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:29:34 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:29:36 dovecot_login authenticator failed for H=(RhrFzGT2) [91.92.240.235]:62686: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:29:06 dovecot_login authenticator failed for H=(LBCRVC) [185.230.124.69]:55746: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:30:24 dovecot_login authenticator failed for H=(5BQieqW) [91.92.240.235]:56852: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.111.210
country_id: 1835841
description:
2026-01-31 18:30:38 dovecot_login authenticator failed for H=([14.37.111.210]) [14.37.111.210]:41220: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2026-01-31 18:30:42 dovecot_login authenticator failed for H=([188.124.139.77]) [188.124.139.77]:52076: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:30:03 dovecot_login authenticator failed for H=(Xn6ALW) [185.230.124.69]:54939: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:30:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:30:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 18:30:07 dovecot_login authenticator failed for H=(iUhVwKZC) [69.5.189.21]:62333: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:30:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:30:06 dovecot_login authenticator failed for H=(kPbwYC) [2.58.56.77]:56778: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-31 18:30:19 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:48713: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-31 18:30:41 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:33691: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 18:30:47 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:39718: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:30:08 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:51688: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.69.202.32
country_id: 357994
description:
2026-01-31 18:31:38 dovecot_plain authenticator failed for H=(E43HFC1) [41.69.202.32]:12082: 535 Incorrect authentication data (set_id=teng.info@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.62.103
country_id: 1814991
description:
2026-01-31 18:31:52 dovecot_login authenticator failed for H=([36.135.62.102]) [36.135.62.103]:47288: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:31:12 dovecot_login authenticator failed for H=(fU4Ewi3) [91.92.240.235]:63720: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:31:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:31:19 dovecot_login authenticator failed for H=(M8MYlel) [185.230.124.69]:60025: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:31:32 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:50065: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2026-01-31 18:31:13 dovecot_login authenticator failed for H=([121.179.93.147]) [121.179.93.147]:38564: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:31:17 dovecot_login authenticator failed for H=(OcXlNLX) [2.58.56.77]:53054: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 18:31:19 dovecot_login authenticator failed for H=(ScemxTS2A) [69.5.189.21]:56415: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:31:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:31:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:31:38 dovecot_login authenticator failed for H=(4pOiILVeo) [185.230.124.69]:64119: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:32:02 dovecot_login authenticator failed for H=(XARtaXL) [91.92.240.235]:61979: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:32:09 dovecot_login authenticator failed for H=(i9RVoirMB) [2.58.56.77]:59290: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:32:16 dovecot_login authenticator failed for H=(yGknaTLoCL) [185.230.124.69]:63406: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.16.97.90
country_id: 3469034
description:
2026-01-31 18:32:41 dovecot_login authenticator failed for H=mvx-187-16-97-90.mundivox.com [187.16.97.90]:57204: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 18:32:05 dovecot_login authenticator failed for H=(5XJeKg9fD) [69.5.189.21]:64008: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:32:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:32:30 dovecot_login authenticator failed for H=(eaNK4thLd) [158.94.208.175]:62592: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-31 18:33:01 dovecot_login authenticator failed for H=([144.121.245.65]) [64.72.74.162]:53516: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:32:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:32:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-31 18:32:49 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:57290: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:33:03 dovecot_login authenticator failed for H=(gdzsHWYLA) [158.94.208.175]:51397: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:33:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:33:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 18:33:16 dovecot_login authenticator failed for H=(Hyv1ZEyDu) [69.5.189.21]:59227: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.0.3
country_id: 3469034
description:
2026-01-31 18:33:03 dovecot_login authenticator failed for H=(177-174-0-3.user.vivozap.com.br) [177.174.0.3]:60141: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 18:33:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:33:13 dovecot_login authenticator failed for H=(vQnUtlI) [185.230.124.69]:61325: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 176.120.22.61
country_id: 2017370
description:
2026-01-31 18:33:16 47856 [Warning] Aborted connection 47856 to db: 'unconnected' user: 'unauthenticated' host: '176.120.22.61' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:33:17 dovecot_login authenticator failed for H=(MjYCsm) [91.92.240.235]:63236: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:33:21 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:51825: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:33:12 dovecot_login authenticator failed for H=(RcReRY7XwF) [2.58.56.77]:62747: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 18:33:18 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:36342: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-01-31 18:33:31 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:40298: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.176.183
country_id: 1861060
domain: hmz.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/hmzcom/public_html/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:34:06 dovecot_login authenticator failed for H=(O1nfJfLNb) [91.92.240.235]:60322: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:34:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:34:19 dovecot_login authenticator failed for H=(Y1gpLT7I80) [2.58.56.77]:50401: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 18:34:02 dovecot_login authenticator failed for H=(AVFGw2) [69.5.189.21]:50254: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:34:10 dovecot_login authenticator failed for H=(zBi6ul) [185.230.124.69]:52387: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 18:34:17 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:52864: 535 Incorrect authentication data (set_id=test@sv3.nocser.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.25.253.134
country_id: 1210997
description:
2026-01-31 18:34:42 dovecot_plain authenticator failed for H=(0SD7X7I) [223.25.253.134]:4390: 535 Incorrect authentication data (set_id=wanfazris@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:34:06 dovecot_login authenticator failed for H=(loXGpJPoeI) [158.94.208.175]:52357: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 18:35:13 dovecot_login authenticator failed for H=(Kn3c0r) [69.5.189.21]:61760: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.106.30.85
country_id: 99237
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=8&sub=13 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:35:05 dovecot_login authenticator failed for H=(ZB0f953Rlb) [2.58.56.77]:58847: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:35:07 dovecot_login authenticator failed for H=(Dyqt7f0) [185.230.124.69]:52288: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:35:39 dovecot_login authenticator failed for H=(4zAwou5H) [91.92.240.235]:55136: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:35:05 dovecot_login authenticator failed for H=(eejOFCeAbT) [158.94.208.175]:61152: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:36:05 dovecot_login authenticator failed for H=(N0oZ4V8Zrh) [185.230.124.69]:54810: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:36:05 dovecot_login authenticator failed for H=(QpBjzw) [158.94.208.175]:53092: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:36:12 dovecot_login authenticator failed for H=(C5wX0Ssyj8) [2.58.56.77]:51682: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.113.154
country_id: 2960313
description:
2026-01-31 18:36:48 dovecot_login authenticator failed for H=(ADMIN) [37.46.113.154]:47959: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-31 18:36:42 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:37939: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:36:24 dovecot_login authenticator failed for H=(RL8boKK6y) [185.230.124.69]:51335: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 18:36:30 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 18:36:33 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:52704: 535 Incorrect authentication data (set_id=test@wcc.wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.36.42
country_id: 1819730
description:
2026-01-31 18:36:19 dovecot_login authenticator failed for H=042.36.246.220.static.netvigator.com [220.246.36.42]:64255: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.138.74
country_id: 1269750
description:
2026-01-31 18:36:36 dovecot_login authenticator failed for H=([128.185.241.213]) [125.19.138.74]:40262: 535 Incorrect authentication data (set_id=infos@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:36:03 dovecot_login authenticator failed for H=(0HyZiaK3) [91.92.240.235]:64200: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 18:36:18 H=([167.148.167.71]) [167.148.167.71]:62645 F=<Support@mkmetal.com.my> rejected RCPT <info@mkmetal.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.161.52.149
country_id: 1814991
description:
2026-01-31 18:36:53 dovecot_login authenticator failed for H=([220.161.52.149]) [220.161.52.149]:34378: 535 Incorrect authentication data (set_id=infos)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:37:17 dovecot_login authenticator failed for H=(g3jWDq5) [91.92.240.235]:57227: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 18:37:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.245.255.253
country_id: 1562822
description:
2026-01-31 18:37:26 dovecot_plain authenticator failed for H=(cclyv5vl8mqvnw5s) [103.245.255.253]:33777: 535 Incorrect authentication data (set_id=nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:37:27 dovecot_login authenticator failed for H=(SkG0zSpX) [158.94.208.175]:54167: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.238
country_id: 1814991
description:
2026-01-31 18:37:59 dovecot_login authenticator failed for H=([1.30.20.238]) [1.30.20.238]:51908: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:37:15 dovecot_login authenticator failed for H=(MFybGmzD) [2.58.56.77]:55389: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2026-01-31 18:37:43 dovecot_login authenticator failed for H=([125.16.32.137]) [125.20.228.146]:43922: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 18:37:04 dovecot_login authenticator failed for H=(9OYQsvd) [185.230.124.69]:61000: 535 Incorrect authentication data (set_id=enquiry)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.231.153
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=670775 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:38:22 dovecot_login authenticator failed for H=(wN0Ug0H0AF) [2.58.56.77]:53502: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 18:38:23 H=([167.148.167.71]) [167.148.167.71]:49482 F=<Support@oxbold.com> rejected RCPT <info@oxbold.com>: Sender verify failed


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:38:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:38:05 dovecot_login authenticator failed for H=(ISDKJ0) [91.92.240.235]:61578: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:38:30 dovecot_login authenticator failed for H=(3N2x2en) [158.94.208.175]:52286: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 18:38:28 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:38:28 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:38:58 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:49692: 535 Incorrect authentication data (set_id=test@aircarbonic.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:39:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:39:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:39:14 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:61765: 535 Incorrect authentication data (set_id=test@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:39:21 dovecot_login authenticator failed for H=(IEjo530J) [91.92.240.235]:54503: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:39:05 dovecot_login authenticator failed for H=(p131jq9lvX) [2.58.56.77]:56888: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-01-31 18:39:14 dovecot_login authenticator failed for H=([175.180.129.87]) [175.180.129.87]:39186: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-01-31 18:40:52 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:52864: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 18:40:39 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:65371: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2026-01-31 18:40:50 dovecot_login authenticator failed for H=([123.129.245.249]) [123.129.245.249]:52688: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:40:19 dovecot_login authenticator failed for H=(4yDwkB) [2.58.56.77]:52643: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 18:40:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:40:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:40:08 dovecot_login authenticator failed for H=(b4wmKxjH0) [158.94.208.175]:57805: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-01-31 18:40:23 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:50988: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:40:09 dovecot_login authenticator failed for H=(M1SZ9Pa) [91.92.240.235]:52980: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.63.42.76
country_id: 1814991
description:
2026-01-31 18:40:20 dovecot_login authenticator failed for H=([111.63.42.76]) [111.63.42.76]:24332: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 18:41:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/news.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:41:05 dovecot_login authenticator failed for H=(xunSVI) [2.58.56.77]:60013: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.98
country_id: 1814991
description:
2026-01-31 18:41:14 dovecot_login authenticator failed for H=([1.30.20.98]) [1.30.20.98]:58064: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:41:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:41:26 dovecot_login authenticator failed for H=(XSNbBW) [2.58.56.77]:50212: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.229.254.207
country_id: 2017370
description:
2026-01-31 18:41:56 dovecot_login authenticator failed for H=([87.229.254.207]) [87.229.254.207]:59414: 535 Incorrect authentication data (set_id=infos@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:41:04 dovecot_login authenticator failed for H=(pBu6lk3) [158.94.208.175]:49264: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:41:23 dovecot_login authenticator failed for H=(Fhdidm) [91.92.240.235]:54962: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2026-01-31 18:41:31 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:56483: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.42.197.140
country_id: 1269750
description:
2026-01-31 18:41:46 dovecot_plain authenticator failed for H=(1VT5KO7) [103.42.197.140]:13217: 535 Incorrect authentication data (set_id=teng.info@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:42:11 dovecot_login authenticator failed for H=(gPKkOgF) [2.58.56.77]:53516: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.210.27.53
country_id: 1814991
description:
2026-01-31 18:42:24 dovecot_login authenticator failed for H=([223.210.27.53]) [223.210.27.53]:6710: 535 Incorrect authentication data (set_id=infos)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:42:27 dovecot_login authenticator failed for H=(idGuLX) [158.94.208.175]:58967: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.99.130.2
country_id: 953987
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=87911523583434 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:42:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:42:11 dovecot_login authenticator failed for H=(z5ts5Cf) [91.92.240.235]:58672: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.195.77.177
country_id: 1835841
description:
2026-01-31 18:42:37 dovecot_login authenticator failed for H=([119.195.77.177]) [119.195.77.177]:55127: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.86.148.242
country_id: 1814991
description:
2026-01-31 18:42:45 dovecot_login authenticator failed for H=([223.86.148.242]) [223.86.148.242]:27491: 535 Incorrect authentication data (set_id=infos)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.208
country_id: 732800
description:
2026-01-31 18:42:46 dovecot_login authenticator failed for H=(151.237.115.208.pronet.bg) [151.237.115.208]:44317: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.241.50
country_id: 1814991
description:
2026-01-31 18:43:49 dovecot_login authenticator failed for H=([218.21.241.50]) [218.21.241.50]:42056: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:43:17 dovecot_login authenticator failed for H=(jWD8QchNFa) [2.58.56.77]:62044: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:43:25 dovecot_login authenticator failed for H=(DHCIcpQwuO) [158.94.208.175]:53740: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:43:26 dovecot_login authenticator failed for H=(NF7JbGw) [91.92.240.235]:50680: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:43:42 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:44:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:44:04 dovecot_login authenticator failed for H=(z9bifq3L6Z) [2.58.56.77]:57341: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.91.69.136
country_id: 2635167
description:
2026-01-31 18:44:57 dovecot_login authenticator failed for H=(PSjKFO) [185.91.69.136]:52858: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:44:14 dovecot_login authenticator failed for H=(sA1Yxudg2) [91.92.240.235]:62059: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:44:23 dovecot_login authenticator failed for H=(Munu2GZH) [158.94.208.175]:50541: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 157.230.46.223
country_id: 1880251
domain: geminiflourmill.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:7.71||T:APACHE||REQUEST_URI:/blog/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:44:06 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:57646: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.102.233
country_id: 1814991
description:
2026-01-31 18:45:17 dovecot_login authenticator failed for H=([183.236.102.233]) [183.236.102.233]:42186: 535 Incorrect authentication data (set_id=infos@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:45:08 dovecot_login authenticator failed for H=(BXfID3Eipj) [2.58.56.77]:50735: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:45:27 dovecot_login authenticator failed for H=(Zz8E8S) [91.92.240.235]:65008: 535 Incorrect authentication data (set_id=cky)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.68.240
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=37401514884338 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:45:30 dovecot_login authenticator failed for H=(2jomuDE6) [158.94.208.175]:61261: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.238.122
country_id: 2542007
description:
2026-01-31 18:45:33 dovecot_login authenticator failed for H=([154.146.238.122]) [154.146.238.122]:52514: 535 Incorrect authentication data (set_id=infos)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/languages/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:45:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.137.72.22
country_id: 3017382
description:
2026-01-31 18:45:08 dovecot_plain authenticator failed for H=22.ip-79-137-72.eu (69ssn7nivtorl359btmo92z3ht9dg) [79.137.72.22]:62929: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.91.69.136
country_id: 2635167
description:
2026-01-31 18:45:46 dovecot_login authenticator failed for H=(ZCkEgWDTl) [185.91.69.136]:58299: 535 Incorrect authentication data (set_id=myloo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:46:03 dovecot_login authenticator failed for H=(E3gSbO) [158.94.208.175]:63463: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.91.69.136
country_id: 2635167
description:
2026-01-31 18:46:12 dovecot_login authenticator failed for H=(nqjDzpQZu) [185.91.69.136]:61352: 535 Incorrect authentication data (set_id=myloo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:46:17 dovecot_login authenticator failed for H=(76ySh8WN) [91.92.240.235]:63543: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:46:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:46:31 dovecot_login authenticator failed for H=(2F1xg61WBH) [2.58.56.77]:61748: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:46:09 dovecot_login authenticator failed for H=(UyaAamoeH7) [2.58.56.77]:59068: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:47:18 dovecot_login authenticator failed for H=(FnZm06Kx3P) [2.58.56.77]:54858: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:47:26 dovecot_login authenticator failed for H=(QnscDwD) [91.92.240.235]:51045: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.91.69.136
country_id: 2635167
description:
2026-01-31 18:47:03 dovecot_login authenticator failed for H=(90iIQeyL3) [185.91.69.136]:51722: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:47:09 dovecot_login authenticator failed for H=(KHXLlOxZUL) [158.94.208.175]:57858: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:47:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:48:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-01-31 18:48:04 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:47405: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.226.81
country_id: 1835841
description:
2026-01-31 18:48:17 dovecot_login authenticator failed for H=([121.189.226.81]) [121.189.226.81]:45778: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
country_id: 1605651
description:
2026-01-31 18:48:39 dovecot_login authenticator failed for H=([110.77.137.236]) [110.77.137.236]:55852: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.30
country_id: 1269750
description:
2026-01-31 18:48:04 dovecot_login authenticator failed for H=(aes-static-057.154.22.125.airtel.in) [182.95.119.30]:60888: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:48:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:48:16 dovecot_login authenticator failed for H=(SHt8wn) [91.92.240.235]:63082: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.43.137.90
country_id: 1835841
description:
2026-01-31 18:48:03 dovecot_login authenticator failed for H=([14.43.137.90]) [14.43.137.90]:41842: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
country_id: 1814991
description:
2026-01-31 18:48:59 dovecot_login authenticator failed for H=([112.194.142.167]) [112.194.142.167]:51774: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-01-31 18:48:06 dovecot_login authenticator failed for H=([175.180.129.87]) [175.180.129.87]:46104: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:48:05 dovecot_login authenticator failed for H=(a1QBFLeHu) [2.58.56.77]:50576: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:48:13 dovecot_login authenticator failed for H=(bo84kUW) [158.94.208.175]:57457: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.168.71.109
country_id: 1835841
description:
2026-01-31 18:48:24 dovecot_login authenticator failed for H=([112.168.71.109]) [112.168.71.109]:56710: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.237.122.113
country_id: 99237
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=46061514946811 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 18:49:38 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.247.248.154
country_id: 3469034
description:
2026-01-31 18:49:48 dovecot_login authenticator failed for H=([170.247.248.154]) [170.247.248.154]:35866: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.211
country_id: 6252001
description:
2026-01-31 18:49:53 dovecot_login authenticator failed for H=(wllk99-129-211.dsl.netins.net) [67.55.189.211]:43796: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.248.146
country_id: 1269750
description:
2026-01-31 18:49:59 dovecot_login authenticator failed for H=([122.184.117.237]) [128.185.248.146]:43526: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:49:04 dovecot_login authenticator failed for H=(V3qL4x) [91.92.240.235]:63393: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:49:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.91.69.136
country_id: 2635167
description:
2026-01-31 18:49:35 dovecot_login authenticator failed for H=(S2JuFLQgCU) [185.91.69.136]:53558: 535 Incorrect authentication data (set_id=myloo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-01-31 18:49:38 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:42857: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 18:49:07 H=([167.148.167.71]) [167.148.167.71]:55782 F=<Support@ktlog.com.my> rejected RCPT <inquiries@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:49:08 dovecot_login authenticator failed for H=(RKxzNo) [158.94.208.175]:62953: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 18:49:18 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:55521: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 185.93.89.64
country_id: 130758
description:
Jan 31 18:49:44 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account inquiries@ktlog.com.my has been temporarily locked by Imunify PAM(185.93.89.64)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2026-01-31 18:49:48 dovecot_login authenticator failed for H=([70.120.1.74]) [70.120.1.74]:54256: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:49:06 dovecot_login authenticator failed for H=(I6x7oJ9yK) [2.58.56.77]:57043: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 18:50:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:50:11 dovecot_login authenticator failed for H=(geRJj4) [2.58.56.77]:49431: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2026-01-31 18:50:13 dovecot_login authenticator failed for H=([152.52.199.126]) [152.52.199.126]:53896: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.236.187.43
country_id: 2017370
description:
2026-01-31 18:50:10 dovecot_login authenticator failed for H=(p187-43.samaralan.ru) [85.236.187.43]:48170: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.168
country_id: 337996
description:
2026-01-31 18:50:13 dovecot_login authenticator failed for H=([196.190.220.168]) [196.190.220.168]:52492: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.247.245.61
country_id: 1835841
description:
2026-01-31 18:50:27 dovecot_login authenticator failed for H=([1.247.245.61]) [1.247.245.61]:45387: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.246.89.70
country_id: 1835841
description:
2026-01-31 18:50:10 dovecot_login authenticator failed for H=([106.246.89.70]) [106.246.89.70]:43237: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.112.194.160
country_id: 1814991
description:
2026-01-31 18:50:14 dovecot_login authenticator failed for H=([106.112.194.160]) [106.112.194.160]:38474: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.114
country_id: 1269750
description:
2026-01-31 18:50:01 dovecot_login authenticator failed for H=(nsg-corporate-17.50.186.122.airtel.in) [182.95.61.114]:50068: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:50:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:50:17 dovecot_login authenticator failed for H=(A8tgEPQ) [91.92.240.235]:56499: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:50:10 dovecot_login authenticator failed for H=(WXWjyb) [158.94.208.175]:56243: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:51:34 dovecot_login authenticator failed for H=(njQgpD0) [2.58.56.77]:62680: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:51:15 dovecot_login authenticator failed for H=(iyuYBwv) [158.94.208.175]:52380: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.163.21
country_id: 1269750
domain: evergrown.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:68104.evergrown.com.my||ServerName:evergrown.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b79048020d1d9bf5927f436c35355c155b5554a1||Title:0xae2b1524||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:51:52 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.23.199.238
country_id: 2921044
description:
2026-01-31 18:51:32 dovecot_login authenticator failed for H=([193.23.199.238]) [193.23.199.238]:40362: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.134.31.193
country_id: 1835841
description:
2026-01-31 18:51:42 dovecot_login authenticator failed for H=([121.134.31.193]) [121.134.31.193]:50825: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:51:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:51:06 dovecot_login authenticator failed for H=(u4fJgY) [91.92.240.235]:53533: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.67.36
country_id: 1814991
description:
2026-01-31 18:51:44 dovecot_login authenticator failed for H=([111.26.67.35]) [111.26.67.36]:45012: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.183
country_id: 1269750
description:
2026-01-31 18:51:51 dovecot_login authenticator failed for H=(nsg-corporate-183.230.187.122.airtel.in) [122.187.230.183]:51297: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 18:51:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:51:15 dovecot_login authenticator failed for H=(wV0RFOYtI) [2.58.56.77]:59401: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:52:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:52:18 dovecot_login authenticator failed for H=(lQoZbA) [91.92.240.235]:56457: 535 Incorrect authentication data (set_id=cky)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.60.154.106
country_id: 1168579
domain: feliogroup.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:33395.feliogroup.com.my||ServerName:feliogroup.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:448416aaa064125082fd82bb8ac79428eca258d6||Title:0xc18ec0ec||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:52:15 dovecot_login authenticator failed for H=(juHyfvCApm) [2.58.56.77]:51332: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:52:16 dovecot_login authenticator failed for H=(rkvftZU2J) [158.94.208.175]:58349: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-01-31 18:52:17 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:54341: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:52:37 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:65035: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
country_id: 1814991
description:
2026-01-31 18:52:09 dovecot_login authenticator failed for H=([182.42.113.10]) [182.42.113.10]:43008: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:52:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 18:52:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-31 18:52:53 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:57500: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/demos/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 18:53:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:53:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.10.217.223
country_id: 3489940
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpunit/phpunit-mock-objects/tests/Builder/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:53:17 dovecot_login authenticator failed for H=(LLm7Hn70YE) [2.58.56.77]:54554: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.236.119.62
country_id: 1880251
description:
Jan 31 18:53:24 sv3 pure-ftpd[177318]: (?@47.236.119.62) [WARNING] Authentication failed for user [woodlinetrd@gmail.com]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:53:11 dovecot_login authenticator failed for H=(b1OhXxa) [158.94.208.175]:49296: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:53:08 dovecot_login authenticator failed for H=(CLWgyHRew) [91.92.240.235]:49827: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:53:12 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:60364: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.183.202.218
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpunit/phpunit-mock-objects/tests/Builder HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/img/img/demos/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: advisorygroup.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/class.php||SC:/home2/advi3535/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:54:24 dovecot_login authenticator failed for H=(2YEzup) [158.94.208.175]:65082: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:54:18 dovecot_login authenticator failed for H=(0uICWAMWNz) [91.92.240.235]:58043: 535 Incorrect authentication data (set_id=cky)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.211.164.12
country_id: 2077456
domain: advisorygroup.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/advi3535/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:54:04 dovecot_login authenticator failed for H=(0o2O7GSVC) [2.58.56.77]:64513: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.105.111.144
country_id: 2017370
description:
2026-01-31 18:54:07 dovecot_plain authenticator failed for H=(pji2cldwa9b7cqnrr1i) [185.105.111.144]:42580: 535 Incorrect authentication data (set_id=fasya@pftfood.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.2.109.8
country_id: 1694008
domain: feliogroup.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:77196.feliogroup.com.my||ServerName:feliogroup.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:eff7c20379d8d671e5d1debea3fc71e79513a225||Title:0x21339710||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:54:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/demos/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:55:07 dovecot_login authenticator failed for H=(H8vrU5d) [91.92.240.235]:52689: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.203.28
country_id: 1831722
description:
2026-01-31 18:55:44 dovecot_login authenticator failed for H=([36.37.203.28]) [36.37.203.28]:34734: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2026-01-31 18:55:02 dovecot_login authenticator failed for H=([221.209.48.203]) [221.209.48.203]:59768: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.129.118.42
country_id: 2921044
description:
2026-01-31 18:55:18 dovecot_plain authenticator failed for H=vps-249871a3.vps.ovh.net (WIN-A2HH3EVVM7G.openstacklocal) [57.129.118.42]:49615: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:55:02 dovecot_login authenticator failed for H=(0YeHliVMX) [158.94.208.175]:53116: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-01-31 18:55:14 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:56128: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.200.240.65
country_id: 2017370
description:
2026-01-31 18:55:28 dovecot_plain authenticator failed for H=ismtj.co (ihvunh8iv3zyao44ljdang1) [185.200.240.65]:45342: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:55:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:55:10 dovecot_login authenticator failed for H=(iHG5fl) [2.58.56.77]:62244: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:56:21 dovecot_login authenticator failed for H=(cV7t95n) [91.92.240.235]:58886: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:56:21 dovecot_login authenticator failed for H=(dwLIusm) [158.94.208.175]:65184: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.27.61.81
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=88061522226299 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:56:41 dovecot_login authenticator failed for H=(YhsWOvoNax) [2.58.56.77]:50596: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-31 18:56:02 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:34508: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 18:56:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:56:19 dovecot_login authenticator failed for H=(atvAcOwIF) [2.58.56.77]:63558: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:57:32 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:57:12 dovecot_login authenticator failed for H=(fYycKWI) [158.94.208.175]:58400: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:57:10 dovecot_login authenticator failed for H=(MDEjQ4GMF) [91.92.240.235]:65103: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:57:02 dovecot_login authenticator failed for H=(qoAaBf7) [2.58.56.77]:56809: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:58:07 dovecot_login authenticator failed for H=(0wZ7bfsFT) [2.58.56.77]:55520: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 18:58:39 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:49963: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:58:43 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.49.70.164
country_id: 1269750
domain: feliogroup.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:71197.feliogroup.com.my||ServerName:feliogroup.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:71d62a7690ff1291f4b0eb2473bba2c6fcef34fa||Title:0x8379c7ba||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:58:45 dovecot_login authenticator failed for H=(kyQxW8) [91.92.240.235]:56954: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:58:08 dovecot_login authenticator failed for H=(j2jzp7EnpO) [158.94.208.175]:64430: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 31 18:59:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 18:59:12 dovecot_login authenticator failed for H=(d3phfd4) [2.58.56.77]:54817: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-31 18:59:14 dovecot_login authenticator failed for H=(K0Eg1JAER8) [91.92.240.235]:54667: 535 Incorrect authentication data (set_id=cky)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 18:59:08 dovecot_login authenticator failed for H=(CLVIMp3) [158.94.208.175]:58997: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.146.19.89
country_id: 1694008
domain: fimco.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:53676.fimco.com.my||ServerName:fimco.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a4eab999de35a73ce189a9ee6d52c1aaf7894d05||Title:0xa5c105c4||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 18:59:27 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:57813: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:00:10 dovecot_login authenticator failed for H=(HZwjJFqps) [158.94.208.175]:49874: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:00:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:00:20 dovecot_login authenticator failed for H=(oaPbmd0) [2.58.56.77]:62275: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:00:03 dovecot_login authenticator failed for H=(jfNRkyZ) [158.94.208.175]:59813: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:01:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.203.138.205
country_id: 6252001
description:
[2026-01-31 19:01:03 +0800] info [cpaneld] 71.203.138.205 - cofreth "GET /login/?login_only=1&user=cofreth&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.195.115.128
country_id: 6252001
description:
[2026-01-31 19:01:17 +0800] info [cpaneld] 68.195.115.128 - cofrethcomm "GET /login/?login_only=1&user=cofrethcomm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofrethcomm (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:01:05 dovecot_login authenticator failed for H=(zEXk5t8L) [2.58.56.77]:50024: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.42.21.161
country_id: 6252001
description:
[2026-01-31 19:01:33 +0800] info [cpaneld] 47.42.21.161 - cofret "GET /login/?login_only=1&user=cofret&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofret (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.197.64.180
country_id: 6252001
description:
[2026-01-31 19:01:48 +0800] info [cpaneld] 98.197.64.180 - cof "GET /login/?login_only=1&user=cof&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cof (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 19:01:02 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:51042: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:01:08 dovecot_login authenticator failed for H=(JZGUZScP) [158.94.208.175]:50065: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.124.191.250
country_id: 6252001
description:
[2026-01-31 19:01:15 +0800] info [cpaneld] 172.124.191.250 - cofrethcommy "GET /login/?login_only=1&user=cofrethcommy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofrethcommy (has_cpuser_file failed)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.176.183
country_id: 1861060
domain: autogreastar.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home/autogrea/public_html/images/index.php||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.206.146.87
country_id: 6252001
description:
[2026-01-31 19:01:41 +0800] info [cpaneld] 68.206.146.87 - cofr "GET /login/?login_only=1&user=cofr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofr (has_cpuser_file failed)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.203.139.29
country_id: 2658434
domain: autogreastar.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home/autogrea/public_html/assets||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.153.126.153
country_id: 6252001
description:
[2026-01-31 19:01:20 +0800] info [cpaneld] 24.153.126.153 - cofrethcom "GET /login/?login_only=1&user=cofrethcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.34.174.155
country_id: 6252001
description:
[2026-01-31 19:01:24 +0800] info [cpaneld] 100.34.174.155 - cofrethco "GET /login/?login_only=1&user=cofrethco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofrethco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.119.126.183
country_id: 6252001
description:
[2026-01-31 19:01:30 +0800] info [cpaneld] 24.119.126.183 - cofrethc "GET /login/?login_only=1&user=cofrethc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofrethc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.222.123.253
country_id: 6252001
description:
[2026-01-31 19:01:36 +0800] info [cpaneld] 108.222.123.253 - cofre "GET /login/?login_only=1&user=cofre&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofre (has_cpuser_file failed)


plugin: modsec
rule: 77142124
name: IM360 WAF: T rack WordPress registration flood
abuser: 160.250.133.80
country_id: 1562822
domain: eminent.st
description:
IM360 WAF: T  rack WordPress registration flood||WPU:||RSV:7.71||T:APACHE||MVN:ARGS:action||MV:register||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:02:11 dovecot_login authenticator failed for H=(f9UiBDP) [158.94.208.175]:54745: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:02:08 dovecot_login authenticator failed for H=(99Yh49r0) [2.58.56.77]:53792: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.111.210
country_id: 1835841
description:
2026-01-31 19:02:35 dovecot_login authenticator failed for H=([14.37.111.210]) [14.37.111.210]:52808: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.203.139.29
country_id: 2658434
domain: autogreastar.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2024/index.php||SC:/home/autogrea/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.164
country_id: 1269750
description:
2026-01-31 19:02:50 dovecot_login authenticator failed for H=(nsg-corporate-164.227.187.122.airtel.in) [122.187.227.164]:45032: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.123.109.43
country_id: 732800
description:
2026-01-31 19:02:24 dovecot_login authenticator failed for H=(ADMIN) [93.123.109.43]:54100: 535 Incorrect authentication data (set_id=enquiry@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:03:13 dovecot_login authenticator failed for H=(v7fcBxDT4G) [2.58.56.77]:52943: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 19:03:04 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:24164: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:03:13 dovecot_login authenticator failed for H=(y3Wycnw) [158.94.208.175]:53645: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
country_id: 3932488
description:
2026-01-31 19:03:08 dovecot_login authenticator failed for H=([45.170.50.2]) [45.170.50.2]:56751: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-01-31 19:03:34 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:43046: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/about-us/images/sliders/career.php||SC:/home/sutsbcom/public_html/about-us||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.42
country_id: 1149361
description:
2026-01-31 19:03:25 dovecot_login authenticator failed for H=([149.54.15.42]) [149.54.15.42]:39656: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2026-01-31 19:03:34 dovecot_login authenticator failed for H=(187-8-89-120.customer.tdatabrasil.net.br) [177.27.76.210]:47270: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.54.22.11
country_id: 1835841
description:
2026-01-31 19:03:02 dovecot_login authenticator failed for H=([14.54.22.11]) [14.54.22.11]:10107: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-01-31 19:04:25 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:50476: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:04:30 dovecot_login authenticator failed for H=(jSx4qoR12) [158.94.208.175]:62098: 535 Incorrect authentication data (set_id=rosliza)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.209.37.219
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/33chartcreate-area.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.73.174
country_id: 1814991
description:
2026-01-31 19:04:02 dovecot_login authenticator failed for H=([60.8.73.174]) [60.8.73.174]:16718: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.246.3.236
country_id: 1835841
description:
2026-01-31 19:04:43 dovecot_login authenticator failed for H=(localhost) [49.246.3.236]:58768: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.89.116.5
country_id: 6252001
description:
2026-01-31 19:04:48 dovecot_login authenticator failed for H=(70-89-116.5-BusName-WA.hfc.comcastbusiness.net) [70.89.116.5]:35324: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
country_id: 1814991
description:
2026-01-31 19:04:52 dovecot_login authenticator failed for H=([111.61.177.190]) [111.61.177.190]:48816: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.117.232.42
country_id: 2017370
description:
2026-01-31 19:04:55 dovecot_login authenticator failed for H=([85.117.232.42]) [85.117.232.42]:36262: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:04:20 dovecot_login authenticator failed for H=(E6jENM) [2.58.56.77]:60838: 535 Incorrect authentication data (set_id=spyong)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/fphortier/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.134
country_id: 1269750
description:
2026-01-31 19:05:59 dovecot_login authenticator failed for H=([182.79.70.225]) [182.95.230.134]:41278: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.127.128
country_id: 3144096
description:
2026-01-31 19:06:01 dovecot_login authenticator failed for H=(cm-46.212.127.128.get.no) [46.212.127.128]:55150: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:05:02 dovecot_login authenticator failed for H=(N91aOB1xA) [2.58.56.77]:64955: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:05:08 dovecot_login authenticator failed for H=(03NLd1) [158.94.208.175]:63254: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:05:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:05:23 dovecot_login authenticator failed for H=(fhqGZe) [2.58.56.77]:60693: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-01-31 19:05:25 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:48494: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.29.231.106
country_id: 1814991
description:
2026-01-31 19:05:51 dovecot_login authenticator failed for H=(hn.kd.ny.adsl) [218.29.231.106]:49543: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.170
country_id: 1814991
description:
2026-01-31 19:05:57 dovecot_login authenticator failed for H=([116.114.84.170]) [116.114.84.170]:38759: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.246
country_id: 1814991
description:
2026-01-31 19:05:11 dovecot_login authenticator failed for H=([116.114.84.246]) [116.114.84.246]:58540: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2026-01-31 19:06:23 dovecot_login authenticator failed for H=([123.129.245.249]) [123.129.245.249]:34100: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.84.92.45
country_id: 1655842
description:
2026-01-31 19:06:39 dovecot_login authenticator failed for H=([115.84.92.45]) [115.84.92.45]:34938: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:06:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.162.18.150
country_id: 1835841
description:
2026-01-31 19:06:25 dovecot_login authenticator failed for H=([112.162.18.150]) [112.162.18.150]:52557: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 19:06:46 H=([167.148.167.71]) [167.148.167.71]:51248 F=<Support@ajplantations.com.my> rejected RCPT <kasim_kn@ajplantations.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-31 19:06:52 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:42124: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:06:02 dovecot_login authenticator failed for H=(TWGgXDHj) [2.58.56.77]:60454: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.87.70
country_id: 1814991
description:
2026-01-31 19:06:08 dovecot_login authenticator failed for H=([111.61.87.70]) [111.61.87.70]:46872: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.168.12.14
country_id: 2017370
description:
2026-01-31 19:06:35 dovecot_login authenticator failed for H=(14.12.168.188.retail.ttk.ru) [188.168.12.14]:56152: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:06:05 dovecot_login authenticator failed for H=(q5aukpcvi) [158.94.208.175]:63711: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:07:02 dovecot_login authenticator failed for H=(paETvUB) [2.58.56.77]:58764: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-01-31 19:07:44 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:38192: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 19:07:04 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:50775: 535 Incorrect authentication data (set_id=test@aircarbonic.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.152.240
country_id: 1861060
domain: astlog.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home/astlogc/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:07:14 dovecot_login authenticator failed for H=(XwX32y) [158.94.208.175]:52975: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:07:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.245
country_id: 1814991
description:
2026-01-31 19:07:26 dovecot_login authenticator failed for H=([111.61.176.245]) [111.61.176.245]:32648: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:08:15 dovecot_login authenticator failed for H=(Ufm29Q3xEy) [158.94.208.175]:51681: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:08:40 dovecot_login authenticator failed for H=(8L3jeYw) [158.94.208.175]:57384: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.42.42
country_id: 690791
description:
2026-01-31 19:08:17 dovecot_login authenticator failed for H=(ADMIN) [84.239.42.42]:29158: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:08:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 19:08:08 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:65245: 535 Incorrect authentication data (set_id=test@symphony-led.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/languages/images/sliders/images/sliders/cdn-cgi/l/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.176.183
country_id: 1861060
domain: zrrtc.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/dpscomsec/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:08:09 dovecot_login authenticator failed for H=(XZcwYj24y) [2.58.56.77]:62493: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-01-31 19:08:06 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:41550: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:09:15 dovecot_login authenticator failed for H=(Po0j3b) [2.58.56.77]:56623: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.196.96
country_id: 3469034
description:
2026-01-31 19:09:02 dovecot_login authenticator failed for H=(96.196.181.45.datasysteminfor.com.br) [45.181.196.96]:50007: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:09:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.170.251.33
country_id: 2017370
description:
2026-01-31 19:09:12 dovecot_login authenticator failed for H=(178.170.251.33.leadertelecom.ru) [178.170.251.33]:52066: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:09:21 dovecot_login authenticator failed for H=(K797WBIx) [158.94.208.175]:56496: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:10:19 dovecot_login authenticator failed for H=(EZJOvRqxoM) [2.58.56.77]:57252: 535 Incorrect authentication data (set_id=spyong)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 105.112.101.42
country_id: 2328926
domain: fkr.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:59387.fkr.com.my||ServerName:fkr.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:77bf3bf3650260a12ab4e0c7798e6bc2f308cef0||Title:0x08384354||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:10:20 dovecot_login authenticator failed for H=(TaaD2b) [158.94.208.175]:64001: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2026-01-31 19:11:40 dovecot_login authenticator failed for H=(138.219.244.10.static.softdados.net) [177.128.209.48]:45124: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:11:18 dovecot_login authenticator failed for H=(CrNUyht3R6) [158.94.208.175]:59812: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.228.237.90
country_id: 1814991
description:
2026-01-31 19:11:42 dovecot_login authenticator failed for H=([221.228.237.90]) [221.228.237.90]:22620: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-31 19:11:53 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:27382: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.187.147.63
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/index.php/uk/clients.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:11:21 dovecot_login authenticator failed for H=(kRrdoQEHbj) [2.58.56.77]:63024: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.87.70
country_id: 1814991
description:
2026-01-31 19:11:24 dovecot_login authenticator failed for H=([111.61.87.70]) [111.61.87.70]:23218: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-31 19:12:00 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:56232: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.65.146
country_id: 1269750
description:
2026-01-31 19:11:29 dovecot_login authenticator failed for H=(nsg-corporate-146.65.185.122.airtel.in) [122.185.65.146]:55612: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 19:11:59 H=([167.148.167.71]) [167.148.167.71]:49315 F=<Support@tujusetia.my> rejected RCPT <kokfoh.liau@tujusetia.my>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: oxbold.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/class.php||SC:/home/oxboldc/public_html/images/class.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:12:02 dovecot_login authenticator failed for H=(0EaUcVKP) [2.58.56.77]:62112: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.69.255.239
country_id: 1814991
description:
2026-01-31 19:12:21 dovecot_login authenticator failed for H=([117.69.255.239]) [117.69.255.239]:43490: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2026-01-31 19:12:20 dovecot_login authenticator failed for H=(189-108-129-173.customer.tdatabrasil.net.br) [187.8.64.94]:41185: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:12:24 dovecot_login authenticator failed for H=(rVgPrXqSR) [158.94.208.175]:65380: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.250.51.2
country_id: 1168579
description:
2026-01-31 19:12:31 dovecot_login authenticator failed for H=([160.250.51.2]) [160.250.51.2]:49878: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.58
country_id: 1269750
description:
2026-01-31 19:12:33 dovecot_login authenticator failed for H=(nsg-corporate-129.168.187.122.airtel.in) [125.19.163.58]:34714: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:12:51 dovecot_login authenticator failed for H=(TKswqz) [158.94.208.175]:58431: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 13.75.54.243
country_id: 1819730
domain: oxbold.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/oxboldc/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:13:07 dovecot_login authenticator failed for H=(eRYxRHwp) [2.58.56.77]:54094: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:13:17 dovecot_login authenticator failed for H=(kx2PAz) [158.94.208.175]:55485: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.94.121.82
country_id: 1835841
description:
2026-01-31 19:13:34 dovecot_login authenticator failed for H=([115.94.121.82]) [115.94.121.82]:35849: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 80.94.254.29
country_id: 617790
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/advertise.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:13:48 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:14:28 dovecot_login authenticator failed for H=(renjjkfT) [158.94.208.175]:53383: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.237.155.150
country_id: 1835841
description:
2026-01-31 19:14:09 dovecot_login authenticator failed for H=([1.237.155.150]) [1.237.155.150]:45780: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:14:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.25.254
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/index.php/uk/exhibition.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:14:13 dovecot_login authenticator failed for H=(Cg9mh0) [2.58.56.77]:62536: 535 Incorrect authentication data (set_id=spyong)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.134.203.24
country_id: 1210997
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/news.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.217.86
country_id: 1814991
description:
2026-01-31 19:14:06 dovecot_login authenticator failed for H=([183.167.217.86]) [183.167.217.86]:51021: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/druma_photos/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
country_id: 2635167
description:
2026-01-31 19:14:41 dovecot_login authenticator failed for H=(165-220-169-113.cust.exede.net) [165.220.169.113]:51868: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:15:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 19:15:35 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:58408: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/img/photos/team.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:15:20 dovecot_login authenticator failed for H=(2FvLlmWlKM) [2.58.56.77]:57915: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:15:17 dovecot_login authenticator failed for H=(gTldomTJq) [158.94.208.175]:59297: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:16:48 dovecot_login authenticator failed for H=(KavV4D) [158.94.208.175]:52422: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:16:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.161.131
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/facilities.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 19:16:24 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:52071: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:16:03 dovecot_login authenticator failed for H=(U9wc3R) [158.94.208.175]:64899: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:16:09 dovecot_login authenticator failed for H=(ZoPSpKXF) [2.58.56.77]:59125: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.177
country_id: 2186224
description:
2026-01-31 19:17:12 dovecot_login authenticator failed for H=([121.73.163.177]) [121.73.163.177]:55208: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.164.148.87
country_id: 1512440
description:
2026-01-31 19:17:27 dovecot_login authenticator failed for H=([62.164.148.87]) [62.164.148.87]:56722: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:17:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-31 19:17:46 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:59485: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 19:17:15 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:53086: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:17:08 dovecot_login authenticator failed for H=(QbPneJQ2) [158.94.208.175]:54252: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:17:56 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:54505: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:17:15 dovecot_login authenticator failed for H=(QoDVULEKt) [2.58.56.77]:55609: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:18:02 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:57090: 535 Incorrect authentication data (set_id=testing@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:18:03 dovecot_login authenticator failed for H=(3ATkHJk) [158.94.208.175]:65151: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.129.118.42
country_id: 2921044
description:
2026-01-31 19:18:24 dovecot_plain authenticator failed for H=vps-249871a3.vps.ovh.net (WIN-A2HH3EVVM7G.openstacklocal) [57.129.118.42]:51031: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:18:26 dovecot_login authenticator failed for H=(H4HYdHmpk) [2.58.56.77]:52907: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.191.243.91
country_id: 1814991
description:
2026-01-31 19:18:55 dovecot_login authenticator failed for H=([222.191.243.91]) [222.191.243.91]:42530: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:18:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.121.113.24
country_id: 3865483
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/index.php/uk/history.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-01-31 19:18:34 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:58829: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.233.190
country_id: 1835841
description:
2026-01-31 19:18:59 dovecot_login authenticator failed for H=([106.10.69.50]) [183.108.233.190]:52405: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.205.169
country_id: 1733045
description:
2026-01-31 19:18:16 dovecot_login authenticator failed for H=([49.124.205.169]) [49.124.205.169]:54576: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2026-01-31 19:18:03 dovecot_login authenticator failed for H=([152.52.234.134]) [125.20.245.182]:51042: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:19:48 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:62891: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/images/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:19:01 dovecot_login authenticator failed for H=(PgtX2Lm) [158.94.208.175]:56098: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:19:10 dovecot_login authenticator failed for H=(DL4aHA) [2.58.56.77]:54161: 535 Incorrect authentication data (set_id=spyong)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:19:16 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:52461: 535 Incorrect authentication data (set_id=testing@wcc.wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.37.177.219
country_id: 1814991
description:
2026-01-31 19:19:10 dovecot_login authenticator failed for H=([153.37.177.219]) [153.37.177.219]:43228: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.194.34.131
country_id: 1835841
domain: vmsmotorsports.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/vmsadmin/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-01-31 19:20:53 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:35529: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:20:11 dovecot_login authenticator failed for H=(xy8dqsb6Wn) [158.94.208.175]:63144: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:20:18 dovecot_login authenticator failed for H=(03atxcEw3d) [2.58.56.77]:51767: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:20:55 dovecot_login authenticator failed for H=(dnS5cW9) [178.16.54.22]:60301: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.247.7.83
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=24461515983341 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-01-31 19:20:34 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:36428: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/home/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:21:03 dovecot_login authenticator failed for H=(XBTlSkRN) [2.58.56.77]:56183: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:21:17 dovecot_login authenticator failed for H=(fAwqYl) [158.94.208.175]:61461: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.247
country_id: 1269750
description:
2026-01-31 19:21:22 dovecot_login authenticator failed for H=(nsg-corporate-247.229.187.122.airtel.in) [122.187.229.247]:32985: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:21:24 dovecot_login authenticator failed for H=(O6SqVlEa) [178.16.54.22]:58542: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:22:11 dovecot_login authenticator failed for H=(vQQtwGhlw) [2.58.56.77]:64395: 535 Incorrect authentication data (set_id=spyong)


