# incident

plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: gagasanteguh.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/class.php||SC:/home2/gagasanteguhcom/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:22:03 dovecot_login authenticator failed for H=(VSlMujMS) [158.94.208.175]:56683: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:22:29 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:22:42 dovecot_login authenticator failed for H=(khYk8N9EL) [178.16.54.22]:61537: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:23:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:23:14 dovecot_login authenticator failed for H=(AGoDRbtJxz) [2.58.56.77]:61218: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:23:33 dovecot_login authenticator failed for H=(BFPm2x8) [178.16.54.22]:54998: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-01-31 19:23:44 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:53870: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:23:08 dovecot_login authenticator failed for H=(OMSXYwL4e) [158.94.208.175]:52617: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.179
country_id: 1269750
description:
2026-01-31 19:23:15 dovecot_login authenticator failed for H=([103.146.233.179]) [103.146.233.179]:59341: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.156
country_id: 1269750
description:
2026-01-31 19:23:04 dovecot_login authenticator failed for H=([103.146.233.156]) [103.146.233.156]:49700: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:23:08 dovecot_login authenticator failed for H=(Uoi7yY) [158.94.208.175]:60035: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2026-01-31 19:23:53 dovecot_login authenticator failed for H=([189.108.156.41]) [187.8.64.94]:40491: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-01-31 19:23:32 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:41050: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.230.176.152
country_id: 1269750
description:
2026-01-31 19:23:44 dovecot_login authenticator failed for H=([103.230.176.152]) [103.230.176.152]:46826: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-01-31 19:24:59 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:59660: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:24:02 dovecot_login authenticator failed for H=(ps8Oay) [178.16.54.22]:57235: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:24:06 dovecot_login authenticator failed for H=(a7hSz1) [2.58.56.77]:59395: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.89.228.203
country_id: 1861060
domain: mail.empirelog.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/empi7862/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.87
country_id: 1269750
description:
2026-01-31 19:24:55 dovecot_login authenticator failed for H=(nsg-corporate-87.229.187.122.airtel.in) [122.187.229.87]:33410: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:24:18 dovecot_login authenticator failed for H=(vGYjIyMLJM) [158.94.208.175]:59397: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:24:54 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:60091: 535 Incorrect authentication data (set_id=test@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:25:02 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:57325: 535 Incorrect authentication data (set_id=test@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:25:03 dovecot_login authenticator failed for H=(kChydTzZh) [158.94.208.175]:50043: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:25:12 dovecot_login authenticator failed for H=(CYbtBa) [2.58.56.77]:63089: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:25:19 dovecot_login authenticator failed for H=(T9Z8ShLAh) [178.16.54.22]:64358: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-01-31 19:25:40 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:43958: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:26:16 dovecot_login authenticator failed for H=(hXBeq83) [178.16.54.22]:50935: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 19:26:01 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:25120: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.31
country_id: 1733045
description:
2026-01-31 19:26:06 dovecot_login authenticator failed for H=([49.124.153.31]) [49.124.153.31]:38634: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:26:19 dovecot_login authenticator failed for H=(rlQz4r) [2.58.56.77]:64271: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.242
country_id: 1814991
description:
2026-01-31 19:26:56 dovecot_login authenticator failed for H=([111.61.176.242]) [111.61.176.242]:12060: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.124
country_id: 1668284
description:
2026-01-31 19:26:16 dovecot_login authenticator failed for H=111-70-32-124.emome-ip.hinet.net [111.70.32.124]:37067: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:26:10 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:58234: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2026-01-31 19:26:21 dovecot_login authenticator failed for H=2.135.31.74.dynamic.telecom.kz [2.135.31.74]:51345: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:26:23 dovecot_login authenticator failed for H=(5Y64Wd2J2f) [158.94.208.175]:63976: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-01-31 19:26:24 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:52962: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.41.88
country_id: 1668284
description:
2026-01-31 19:26:26 dovecot_login authenticator failed for H=111-70-41-88.emome-ip.hinet.net [111.70.41.88]:51491: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.62.141.104
country_id: 99237
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/press.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 19:26:06 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:64306: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:27:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-01-31 19:27:56 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:58672: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:27:04 dovecot_login authenticator failed for H=(7HVPCav2eV) [2.58.56.77]:56123: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 19:27:06 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:62080: 535 Incorrect authentication data (set_id=test@symphony-led.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:27:06 dovecot_login authenticator failed for H=(I2t3OUu7) [178.16.54.22]:52679: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:27:09 dovecot_login authenticator failed for H=(Md7OEzu5e) [158.94.208.175]:61448: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:28:05 dovecot_login authenticator failed for H=(4oMhQIB) [158.94.208.175]:63769: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:28:06 dovecot_login authenticator failed for H=(Pa4AF2) [2.58.56.77]:50969: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2026-01-31 19:28:43 dovecot_login authenticator failed for H=([128.185.140.225]) [182.95.176.206]:39734: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:28:03 dovecot_login authenticator failed for H=(4UOiFriGIH) [178.16.54.22]:59007: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.248.4.85
country_id: 1269750
description:
2026-01-31 19:28:22 dovecot_login authenticator failed for H=([115.248.153.209]) [115.248.4.85]:56050: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.17.217.141
country_id: 1814991
description:
2026-01-31 19:28:57 dovecot_login authenticator failed for H=([218.17.217.141]) [218.17.217.141]:24882: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:28:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:29:11 dovecot_login authenticator failed for H=(o3LA6dx) [2.58.56.77]:58245: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.54.65
country_id: 298795
description:
2026-01-31 19:29:43 dovecot_login authenticator failed for H=(78.186.54.65.static.ttnet.com.tr) [78.186.54.65]:37884: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.240
country_id: 2186224
description:
2026-01-31 19:29:47 dovecot_login authenticator failed for H=([121.73.168.240]) [121.73.168.240]:53378: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-01-31 19:29:29 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:33638: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.190.195.22
country_id: 6252001
description:
[2026-01-31 19:29:47 +0800] info [cpaneld] 184.190.195.22 - ca "GET /login/?login_only=1&user=ca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ca (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:29:02 dovecot_login authenticator failed for H=(vZNI65zzNW) [178.16.54.22]:61015: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2026-01-31 19:29:21 dovecot_login authenticator failed for H=(90.pool90-173-78.static.orange.es) [90.173.78.90]:44644: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.156.130.34
country_id: 1269750
description:
2026-01-31 19:29:22 dovecot_login authenticator failed for H=([103.140.18.186]) [49.156.130.34]:47946: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.210.134.164
country_id: 6252001
description:
[2026-01-31 19:29:26 +0800] info [cpaneld] 71.210.134.164 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.3.26
country_id: 6252001
description:
[2026-01-31 19:29:40 +0800] info [cpaneld] 172.58.3.26 - cabec "GET /login/?login_only=1&user=cabec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cabec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.204.22.225
country_id: 6252001
description:
[2026-01-31 19:29:43 +0800] info [cpaneld] 47.204.22.225 - cab "GET /login/?login_only=1&user=cab&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cab (has_cpuser_file failed)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:29:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.151.178
country_id: 6252001
description:
[2026-01-31 19:29:21 +0800] info [cpaneld] 172.56.151.178 - cabe "GET /login/?login_only=1&user=cabe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cabe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.198.32.143
country_id: 6252001
description:
[2026-01-31 19:29:28 +0800] info [cpaneld] 68.198.32.143 - cabecommy "GET /login/?login_only=1&user=cabecommy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cabecommy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.147.138.173
country_id: 6252001
description:
[2026-01-31 19:29:36 +0800] info [cpaneld] 35.147.138.173 - cabeco "GET /login/?login_only=1&user=cabeco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cabeco (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:29:23 dovecot_login authenticator failed for H=(KLAXYksxr7) [158.94.208.175]:51721: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.36.40.106
country_id: 6252001
description:
[2026-01-31 19:29:31 +0800] info [cpaneld] 76.36.40.106 - cabecomm "GET /login/?login_only=1&user=cabecomm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cabecomm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.106.220.146
country_id: 6252001
description:
[2026-01-31 19:29:33 +0800] info [cpaneld] 68.106.220.146 - cabecom "GET /login/?login_only=1&user=cabecom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:30:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:30:22 dovecot_login authenticator failed for H=(9sTQTDE) [178.16.54.22]:64986: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:30:22 dovecot_login authenticator failed for H=(oqDs3B) [158.94.208.175]:57209: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:30:39 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:49187: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-01-31 19:30:59 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:35562: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.87
country_id: 1269750
description:
2026-01-31 19:30:04 dovecot_login authenticator failed for H=(nsg-corporate-87.229.187.122.airtel.in) [122.187.229.87]:38362: 535 Incorrect authentication data


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.24.61.31
country_id: 99237
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/training-details.php?id=785897 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.104
country_id: 1269750
description:
2026-01-31 19:30:03 dovecot_login authenticator failed for H=(nsg-corporate-104.230.187.122.airtel.in) [122.187.230.104]:49800: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-31 19:30:12 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:43734: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:30:16 dovecot_login authenticator failed for H=(Qg9SvDssO) [2.58.56.77]:53781: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.97.118.110
country_id: 2589581
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/activity-details.php?id=255888 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.162
country_id: 1269750
description:
2026-01-31 19:30:06 dovecot_login authenticator failed for H=(nsg-corporate-162.230.187.122.airtel.in) [122.187.230.162]:40374: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:30:43 dovecot_login authenticator failed for H=(WnEK1M3) [158.94.208.175]:54017: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:31:09 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64982: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 19:31:24 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:55682: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:31:06 dovecot_login authenticator failed for H=(fam9PHE) [158.94.208.175]:60331: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:31:02 dovecot_login authenticator failed for H=(CkuO2bjT) [2.58.56.77]:61545: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.225.229.105
country_id: 2077456
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/wing/10/88/1041360 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:31:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.202.173.227
country_id: 2017370
description:
2026-01-31 19:31:50 dovecot_login authenticator failed for H=([109.202.173.227]) [109.202.173.227]:33344: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:32:14 dovecot_login authenticator failed for H=(F0scVF9JF2) [158.94.208.175]:57919: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:32:14 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:51471: 535 Incorrect authentication data (set_id=testing@mams1.manforce.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 19:32:39 H=([167.148.167.71]) [167.148.167.71]:55941 F=<Support@ktlog.com.my> rejected RCPT <marylinkoh@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:32:08 dovecot_login authenticator failed for H=(7fhsqh4) [2.58.56.77]:63350: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.23
country_id: 1269750
description:
2026-01-31 19:32:48 dovecot_login authenticator failed for H=([103.147.248.23]) [103.147.248.23]:54890: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.209.179.31
country_id: 1269750
description:
2026-01-31 19:32:03 dovecot_login authenticator failed for H=([103.209.179.31]) [103.209.179.31]:5427: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:32:13 dovecot_login authenticator failed for H=(ahjhnlbS5t) [178.16.54.22]:50109: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2026-01-31 19:32:48 dovecot_plain authenticator failed for H=(bendown) [65.20.143.159]:47768: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.204.232.244
country_id: 1269750
description:
2026-01-31 19:33:03 dovecot_login authenticator failed for H=(broadband.actcorp.in) [49.204.232.244]:43288: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:33:16 dovecot_login authenticator failed for H=(4KO7Lv) [158.94.208.175]:53358: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-01-31 19:33:41 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:44080: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-31 19:33:51 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:34166: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:33:10 dovecot_login authenticator failed for H=(5DEBUzX) [178.16.54.22]:56784: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:33:17 dovecot_login authenticator failed for H=(w5HU9XA) [2.58.56.77]:57662: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2026-01-31 19:33:27 dovecot_login authenticator failed for H=([222.120.176.6]) [222.120.176.6]:36174: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:34:35 dovecot_login authenticator failed for H=(6jmz67b) [178.16.54.22]:61511: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 19:34:55 dovecot_login authenticator failed for H=(pm4FP0) [45.94.31.131]:64162: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:34:06 dovecot_login authenticator failed for H=(UvF8Xq) [158.94.208.175]:63776: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.126.53.11
country_id: 1835841
description:
2026-01-31 19:34:07 dovecot_login authenticator failed for H=([168.126.53.11]) [168.126.53.11]:35847: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:34:17 dovecot_login authenticator failed for H=(F3Yz07veLM) [158.94.208.175]:62488: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:34:26 dovecot_login authenticator failed for H=(tNH2sV3) [2.58.56.77]:63919: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.87
country_id: 1269750
description:
2026-01-31 19:35:49 dovecot_login authenticator failed for H=(nsg-corporate-87.229.187.122.airtel.in) [122.187.229.87]:52576: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:35:18 dovecot_login authenticator failed for H=(o0Ixp0Ql) [2.58.56.77]:54515: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:35:24 dovecot_login authenticator failed for H=(SBVaL5Mq) [158.94.208.175]:51729: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 19:35:04 dovecot_login authenticator failed for H=(jQckm1) [45.94.31.131]:57734: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:35:03 dovecot_login authenticator failed for H=(pO9KyzID) [178.16.54.22]:60935: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:36:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-01-31 19:36:21 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:46504: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 102.91.102.183
country_id: 2328926
domain: www.u-net.com.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.71||T:APACHE||RA:102.91.102.183||TA:102.91.102.183||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:36:25 dovecot_login authenticator failed for H=(n61nJY3W) [178.16.54.22]:61682: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 19:36:17 dovecot_login authenticator failed for H=(mwiBhR) [45.94.31.131]:56319: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:36:05 dovecot_login authenticator failed for H=(j99IF7R) [2.58.56.77]:49732: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-01-31 19:36:11 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:58324: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:36:14 dovecot_login authenticator failed for H=(12hippW) [158.94.208.175]:55511: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-01-31 19:37:56 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:38580: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:37:34 dovecot_login authenticator failed for H=(MtFExKbhR6) [158.94.208.175]:54540: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:37:45 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:57986: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 19:37:53 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-01-31 19:37:16 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:37064: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.168
country_id: 1269750
description:
2026-01-31 19:37:41 dovecot_login authenticator failed for H=([122.187.229.168]) [122.187.229.168]:59678: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:37:15 dovecot_login authenticator failed for H=(vP8Ptv) [178.16.54.22]:50006: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 19:37:25 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:64258: 535 Incorrect authentication data (set_id=testing@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:37:18 dovecot_login authenticator failed for H=(pnnG0uL8Jp) [2.58.56.77]:51321: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:37:22 dovecot_login authenticator failed for H=(4JTr6UjmAX) [158.94.208.175]:59209: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 19:37:44 H=([167.148.167.71]) [167.148.167.71]:56700 F=<Support@ms-chemicals.net> rejected RCPT <miko@ms-chemicals.net>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 19:37:16 dovecot_login authenticator failed for H=(LVK89GCz) [45.94.31.131]:59448: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:37:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-01-31 19:37:46 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:52008: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:38:07 dovecot_login authenticator failed for H=(TnvX66L) [158.94.208.175]:49635: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 19:38:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 19:38:14 dovecot_login authenticator failed for H=(LURNuAf) [45.94.31.131]:55829: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 19:38:34 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:50407: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.8.113
country_id: 2661886
description:
2026-01-31 19:38:52 dovecot_login authenticator failed for H=(ADMIN) [46.246.8.113]:50342: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:38:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:38:05 dovecot_login authenticator failed for H=(sc0FdX) [2.58.56.77]:52909: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:38:07 dovecot_login authenticator failed for H=(GCaLCF) [178.16.54.22]:60022: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:38:04 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64049: 535 Incorrect authentication data (set_id=test@wcc.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.49.14
country_id: 1814991
description:
2026-01-31 19:38:34 dovecot_login authenticator failed for H=(hebei.18.121.in-addr.arpa) [121.18.49.14]:41990: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-01-31 19:38:55 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:47466: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:39:15 dovecot_login authenticator failed for H=(c2rDtWidaq) [158.94.208.175]:56705: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.30.124.96
country_id: 1814991
description:
2026-01-31 19:39:26 dovecot_login authenticator failed for H=(dns58.online.tj.cn) [111.30.124.96]:15067: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:39:27 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:52807: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 19:39:12 dovecot_login authenticator failed for H=(mr4scj) [45.94.31.131]:54754: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:39:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:39:14 dovecot_login authenticator failed for H=(MjoyOay) [2.58.56.77]:57956: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.206.14
country_id: 1269750
description:
2026-01-31 19:39:21 dovecot_login authenticator failed for H=([203.129.206.14]) [203.129.206.14]:59194: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 31 19:39:55 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:39:04 dovecot_login authenticator failed for H=(9TxqU4) [178.16.54.22]:53848: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 43.251.253.53
country_id: 1168579
domain: gagasanteguh.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:79477.gagasanteguh.com.my||ServerName:gagasanteguh.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:81b1fc9881ab32d4a0b936196b02e3b11e1b908f||Title:0xf2a4420e||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 19:39:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.187
country_id: 1269750
description:
2026-01-31 19:39:46 dovecot_login authenticator failed for H=(nsg-corporate-187.230.187.122.airtel.in) [122.187.230.187]:50026: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-01-31 19:40:50 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:51888: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 19:40:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.246.27
country_id: 2017370
description:
2026-01-31 19:40:17 dovecot_login authenticator failed for H=([46.8.246.27]) [46.8.246.27]:56930: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 19:40:10 dovecot_login authenticator failed for H=(1zgClFHTc) [45.94.31.131]:53431: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-31 19:40:15 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:33078: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:40:44 dovecot_login authenticator failed for H=(Awd8o4) [178.16.54.22]:49442: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:40:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:40:25 dovecot_login authenticator failed for H=(eGwcY96W) [158.94.208.175]:57773: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.150.247
country_id: 1733045
description:
2026-01-31 19:40:29 dovecot_login authenticator failed for H=([49.124.150.247]) [49.124.150.247]:50492: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:40:20 dovecot_login authenticator failed for H=(QJ4QLFnNFZ) [2.58.56.77]:55160: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 31 19:40:42 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2026-01-31 19:42:00 dovecot_login authenticator failed for H=(nsg-corporate-126.176.185.122.airtel.in) [122.185.176.126]:37144: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:41:55 dovecot_login authenticator failed for H=(bPaPdTEEO7) [178.16.54.22]:63503: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.193
country_id: 1733045
description:
2026-01-31 19:41:41 dovecot_login authenticator failed for H=([49.124.159.193]) [49.124.159.193]:40592: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.110.234.188
country_id: 953987
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=2300 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-01-31 19:41:03 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:58830: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:41:05 dovecot_login authenticator failed for H=(c6T324) [2.58.56.77]:63876: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 19:41:07 dovecot_login authenticator failed for H=(UtNOUi) [45.94.31.131]:52063: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:41:33 dovecot_login authenticator failed for H=(xmiwmmf68X) [158.94.208.175]:59479: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 31 19:41:53 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 19:41:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 31 19:42:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 19:42:08 dovecot_login authenticator failed for H=(HQymE0LB) [45.94.31.131]:62629: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:42:13 dovecot_login authenticator failed for H=(iz8Jeg) [2.58.56.77]:55909: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:42:19 dovecot_login authenticator failed for H=(Hgbd5r) [178.16.54.22]:63535: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-01-31 19:42:46 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:47914: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:42:06 dovecot_login authenticator failed for H=(mNepiHMrYg) [158.94.208.175]:58688: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 19:42:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.206.101.240
country_id: 2017370
description:
2026-01-31 19:42:13 dovecot_login authenticator failed for H=(pool-5-206-101-240.is74.ru) [5.206.101.240]:58586: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2026-01-31 19:42:24 dovecot_login authenticator failed for H=(nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:38546: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:42:35 dovecot_login authenticator failed for H=(Aw24Mt9p) [158.94.208.175]:52862: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 19:43:06 dovecot_login authenticator failed for H=(m42Lt8) [45.94.31.131]:64469: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:43:19 dovecot_login authenticator failed for H=(wouIJN) [2.58.56.77]:60009: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:43:56 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:55627: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:43:08 dovecot_login authenticator failed for H=(lTZzx8LDY4) [178.16.54.22]:51952: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 19:43:40 H=([167.148.167.71]) [167.148.167.71]:51310 F=<Support@astlog.com.my> rejected RCPT <mustapa@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:43:03 dovecot_login authenticator failed for H=(u4EWdG8kY) [158.94.208.175]:62150: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:44:06 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:60511: 535 Incorrect authentication data (set_id=testing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2026-01-31 19:44:14 dovecot_login authenticator failed for H=(ip-177-27-76-210.user.vivozap.com.br) [177.27.76.210]:48870: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:44:15 dovecot_login authenticator failed for H=(I8GhCkjQ) [158.94.208.175]:64832: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-31 19:44:40 dovecot_login authenticator failed for H=([144.121.245.65]) [64.72.74.162]:47610: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:44:01 dovecot_login authenticator failed for H=(dpBBvjXY1I) [178.16.54.22]:53681: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-31 19:45:00 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:52996: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:44:46 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.154.34.130
country_id: 298795
description:
2026-01-31 19:44:23 dovecot_login authenticator failed for H=(server.keyubu.com) [94.154.34.130]:51256: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:44:03 dovecot_login authenticator failed for H=(Z4ZKOJmL) [2.58.56.77]:61677: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 19:44:04 dovecot_login authenticator failed for H=(rMG3WGh7mD) [45.94.31.131]:63858: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 19:45:21 dovecot_login authenticator failed for H=(hRpT8kP0) [45.94.31.131]:53110: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:45:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong@ajplantations.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.188.252.208
country_id: 6252001
description:
2026-01-31 19:45:37 dovecot_plain authenticator failed for H=c-73-188-252-208.hsd1.pa.comcast.net (quinacran) [73.188.252.208]:41438: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-31 19:45:41 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:59822: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2026-01-31 19:45:50 dovecot_login authenticator failed for H=([218.149.235.152]) [218.149.235.152]:44004: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.138
country_id: 1819730
description:
2026-01-31 19:45:26 dovecot_login authenticator failed for H=(223-197-153-138.static.imsbiz.com) [223.197.153.138]:65500: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 19:45:27 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:50285: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:45:05 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:52276: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 19:45:32 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (etranic) [87.103.126.54]:23252: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:45:32 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:60513: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-01-31 19:45:19 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:49466: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:45:20 dovecot_login authenticator failed for H=(y3knysB6A9) [178.16.54.22]:59780: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.213.25.189
country_id: 3175395
domain: fimco.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/fimco/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:45:09 dovecot_login authenticator failed for H=(REvx4kAf) [2.58.56.77]:51456: 535 Incorrect authentication data (set_id=spyong@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 19:45:58 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:45:07 dovecot_login authenticator failed for H=(KJRldw2hG8) [158.94.208.175]:49512: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-01-31 19:46:21 dovecot_login authenticator failed for H=([59.145.84.169]) [182.95.176.122]:58588: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:46:21 dovecot_login authenticator failed for H=(P3RnP48) [2.58.56.77]:64686: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 19:46:19 dovecot_login authenticator failed for H=(rtXAvY1S) [45.94.31.131]:64335: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-31 19:46:57 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:55060: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2026-01-31 19:46:01 dovecot_login authenticator failed for H=(1522312565.colombiatel.co) [152.231.25.64]:44484: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.248.4.85
country_id: 1269750
description:
2026-01-31 19:46:06 dovecot_login authenticator failed for H=([115.248.153.209]) [115.248.4.85]:64614: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.232.83.3
country_id: 3175395
domain: aircarbonic.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2024/index.php||SC:/home2/aircarbonicadmin/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.201.39
country_id: 1269750
description:
2026-01-31 19:46:11 dovecot_login authenticator failed for H=([117.248.201.39]) [117.248.201.39]:36589: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:46:10 dovecot_login authenticator failed for H=(EihIqq) [178.16.54.22]:51113: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:46:04 dovecot_login authenticator failed for H=(T8o34e) [158.94.208.175]:54357: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 19:46:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.243.58
country_id: 1814991
description:
2026-01-31 19:46:48 dovecot_login authenticator failed for H=([218.21.243.58]) [218.21.243.58]:56480: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:47:27 dovecot_login authenticator failed for H=(SameqO) [178.16.54.22]:60835: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 19:47:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:47:07 dovecot_login authenticator failed for H=(LOkdnctv) [158.94.208.175]:51122: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:47:09 dovecot_login authenticator failed for H=(CFcWSHJiSF) [2.58.56.77]:51364: 535 Incorrect authentication data (set_id=spyong)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.181.241.82
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=1&sub=19 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 19:47:17 dovecot_login authenticator failed for H=(LGyIHb2p) [45.94.31.131]:54874: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 19:48:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.24.85.10
country_id: 1819730
domain: mams1.manforce.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/manfotp3/mams1.manforce.net/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.29.233
country_id: 3469034
description:
2026-01-31 19:48:33 dovecot_login authenticator failed for H=(gatecidos.static.gvt.net.br) [179.185.29.233]:39575: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.245.178
country_id: 1269750
description:
2026-01-31 19:48:35 dovecot_login authenticator failed for H=(dhcp-192-245-178.in2cable.com) [203.192.245.178]:58834: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:48:49 dovecot_login authenticator failed for H=(TJebS7b) [158.94.208.175]:50039: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 112.201.131.115
country_id: 1694008
description:
Jan 31 19:48:52 sv3 pure-ftpd[209957]: (?@112.201.131.115) [WARNING] Authentication failed for user [inf@cordage.com.my]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:48:01 dovecot_login authenticator failed for H=(XWjBl58) [158.94.208.175]:56070: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 19:48:14 dovecot_login authenticator failed for H=(FY458ucJ) [45.94.31.131]:56548: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.46
country_id: 1269750
description:
2026-01-31 19:48:41 dovecot_login authenticator failed for H=([125.19.156.46]) [125.19.156.46]:40752: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 112.201.131.115
country_id: 1694008
description:
Jan 31 19:48:45 sv3 pure-ftpd[209957]: (?@112.201.131.115) [INFO] New connection from 112.201.131.115


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:49:00 dovecot_login authenticator failed for H=(CjeZkdgm) [178.16.54.22]:53334: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:48:16 dovecot_login authenticator failed for H=(5AamBwQQcR) [2.58.56.77]:49518: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.47.46.174
country_id: 1522867
description:
2026-01-31 19:48:26 dovecot_login authenticator failed for H=([92.47.46.174]) [92.47.46.174]:35614: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.167
country_id: 2750405
description:
2026-01-31 19:49:01 50633 [Warning] Aborted connection 50633 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.167' (This connection closed normally without authentication)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 112.201.131.115
country_id: 1694008
description:
Jan 31 19:49:06 sv3 pure-ftpd[210052]: (?@112.201.131.115) [WARNING] Authentication failed for user [admin]


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 19:49:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:49:14 dovecot_login authenticator failed for H=(I0FHk9Cs0) [158.94.208.175]:60942: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2026-01-31 19:49:41 dovecot_login authenticator failed for H=([173.25.186.130]) [173.25.186.130]:57912: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:49:47 dovecot_login authenticator failed for H=(Qi0rhkmszv) [178.16.54.22]:50612: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 110.235.177.217
country_id: 1694008
domain: garudabay.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:62550.garudabay.com||ServerName:garudabay.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:aa0e450aebd876d652ac1a379debd45fa5ff96ce||Title:0xa5988c83||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 19:49:12 dovecot_login authenticator failed for H=(fDFHdhqeFy) [45.94.31.131]:62627: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 112.201.131.115
country_id: 1694008
description:
Jan 31 19:49:07 sv3 pure-ftpd[210112]: (?@112.201.131.115) [INFO] New connection from 112.201.131.115


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 19:49:09 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:64324: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.201.131.115
country_id: 1694008
description:
2026-01-31 19:49:14 dovecot_plain authenticator failed for H=(DESKTOP-R088EK0) [112.201.131.115]:41967: 535 Incorrect authentication data (set_id=inf@cordage.com.my)


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 112.201.131.115
country_id: 1694008
description:
Jan 31 19:49:44 sv3 pure-ftpd[210487]: (?@112.201.131.115) [INFO] New connection from 112.201.131.115


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:49:48 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:49:02 dovecot_login authenticator failed for H=(OaJ4UUE) [2.58.56.77]:61513: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 11321
name: Active Response. FTP brute force attack (Port 21 is protected)
abuser: 112.201.131.115
country_id: 1694008
description:
Jan 31 19:49:43 sv3 pure-ftpd[210331]: (?@112.201.131.115) [WARNING] Authentication failed for user [inf]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.201.131.115
country_id: 1694008
description:
2026-01-31 19:50:01 dovecot_plain authenticator failed for H=(DESKTOP-R088EK0) [112.201.131.115]:41027: 535 Incorrect authentication data (set_id=inf@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:50:14 dovecot_login authenticator failed for H=(DBsvU6R) [2.58.56.77]:56819: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.189
country_id: 1814991
description:
2026-01-31 19:50:23 dovecot_login authenticator failed for H=([111.61.177.189]) [111.61.177.189]:51148: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.26
country_id: 99237
description:
2026-01-31 19:50:36 dovecot_login authenticator failed for H=([65.20.149.26]) [65.20.149.26]:55332: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.161.196.5
country_id: 99237
description:
2026-01-31 19:50:51 dovecot_login authenticator failed for H=([46.161.196.5]) [46.161.196.5]:49202: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 19:51:00 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:60714: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:50:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:50:11 dovecot_login authenticator failed for H=(7E4XzV) [158.94.208.175]:64718: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:50:17 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:56455: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 19:50:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 19:50:09 dovecot_login authenticator failed for H=(9l2VGWx) [45.94.31.131]:52157: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.22.51.64
country_id: 2017370
description:
2026-01-31 19:50:28 dovecot_login authenticator failed for H=(n51-h64.smr-rsk.metromax.ru) [81.22.51.64]:49752: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.135.251.82
country_id: 2017370
description:
2026-01-31 19:51:29 dovecot_login authenticator failed for H=([79.135.251.82]) [79.135.251.82]:55314: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 19:51:07 dovecot_login authenticator failed for H=(0TpvSDP9w) [45.94.31.131]:58798: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.154.62.229
country_id: 1835841
description:
2026-01-31 19:51:07 dovecot_login authenticator failed for H=([125.154.62.229]) [125.154.62.229]:42976: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.129.18
country_id: 2077456
description:
2026-01-31 19:51:37 dovecot_login authenticator failed for H=202-62-129-18.ip.vocus.network [202.62.129.18]:53422: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.19.165.90
country_id: 3469034
description:
2026-01-31 19:51:37 dovecot_login authenticator failed for H=(secovi-rs.pae.gvt.net.br) [177.19.165.90]:50601: 535 Incorrect authentication data (set_id=noreply)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.201.131.115
country_id: 1694008
description:
2026-01-31 19:51:09 dovecot_plain authenticator failed for H=(DESKTOP-R088EK0) [112.201.131.115]:38616: 535 Incorrect authentication data (set_id=inf@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:51:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.100.159.2
country_id: 1835841
description:
2026-01-31 19:51:18 dovecot_login authenticator failed for H=([222.100.159.2]) [222.100.159.2]:57511: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:51:16 dovecot_login authenticator failed for H=(4IQgiNW3) [2.58.56.77]:53094: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:51:42 dovecot_login authenticator failed for H=(R8eqZjFV) [178.16.54.22]:50242: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 19:51:17 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:51030: 535 Incorrect authentication data (set_id=test@symphony-led.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.49.166
country_id: 1269750
description:
2026-01-31 19:51:24 dovecot_login authenticator failed for H=([182.95.49.166]) [182.95.49.166]:50288: 535 Incorrect authentication data (set_id=noreply@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:51:19 dovecot_login authenticator failed for H=(CAcqKApuEL) [158.94.208.175]:53446: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.167
country_id: 2750405
description:
2026-01-31 19:51:20 50731 [Warning] Aborted connection 50731 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.167' (This connection closed normally without authentication)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.215.116.20
country_id: 2921044
description:
[2026-01-31 19:51:21 +0800] info [webmaild] 85.215.116.20 - payment@tujusetia.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 112.201.131.115
country_id: 1694008
description:
2026-01-31 19:51:50 dovecot_plain authenticator failed for H=(DESKTOP-R088EK0) [112.201.131.115]:41279: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:51:03 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:62323: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.84.70
country_id: 2017370
description:
2026-01-31 19:51:31 dovecot_login authenticator failed for H=(95-165-84-70.dynamic.spd-mgts.ru) [95.165.84.70]:51158: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:52:15 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:55007: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:52:03 dovecot_login authenticator failed for H=(o1a5pNCiNh) [158.94.208.175]:57294: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:52:23 dovecot_login authenticator failed for H=(LzDBKz) [2.58.56.77]:52978: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:52:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.201.131.115
country_id: 1694008
description:
2026-01-31 19:52:22 dovecot_plain authenticator failed for H=(DESKTOP-R088EK0) [112.201.131.115]:39591: 535 Incorrect authentication data (set_id=inf@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 19:52:08 dovecot_login authenticator failed for H=(4rlDKSduS) [45.94.31.131]:49879: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.167
country_id: 2750405
description:
2026-01-31 19:52:25 50756 [Warning] Aborted connection 50756 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.167' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:52:32 dovecot_login authenticator failed for H=(4bK6GP) [178.16.54.22]:60368: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-01-31 19:52:59 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:45972: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:53:09 dovecot_login authenticator failed for H=(2hGAnH) [2.58.56.77]:56001: 535 Incorrect authentication data (set_id=spyong)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 152.42.183.182
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/kimmark/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 19:53:06 dovecot_login authenticator failed for H=(yfMpMYDpaS) [45.94.31.131]:62636: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.121
country_id: 6252001
description:
2026-01-31 19:53:41 dovecot_login authenticator failed for H=([209.23.72.121]) [209.23.72.121]:57262: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:53:09 dovecot_login authenticator failed for H=(kk1hW6pZYI) [158.94.208.175]:54558: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 152.42.183.182
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/index.php||SC:/home2/kimmark/public_html/wp-admin||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:53:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.142.194
country_id: 1269750
description:
2026-01-31 19:53:52 dovecot_login authenticator failed for H=(abts-north-static-194.142.160.122.airtelbroadband.in) [122.160.142.194]:54852: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:54:12 dovecot_login authenticator failed for H=(dJ4Ikc) [178.16.54.22]:60597: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2026-01-31 19:54:02 dovecot_login authenticator failed for H=(cm-178.232.51.135.get.no) [178.232.51.135]:46941: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:54:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-31 19:54:26 H=([45.144.212.50]) [45.144.212.50]:60504 F=<ccmsservice@bangkokbank.com> rejected RCPT <info@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from bangkokbank.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:54:14 dovecot_login authenticator failed for H=(Vur0b1) [2.58.56.77]:62776: 535 Incorrect authentication data (set_id=spyong)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:54:04 dovecot_login authenticator failed for H=(OhInoGC) [158.94.208.175]:51755: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:55:08 dovecot_login authenticator failed for H=(m26kWuD) [178.16.54.22]:52212: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:55:14 dovecot_login authenticator failed for H=(i3WtT0) [158.94.208.175]:51227: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:55:23 dovecot_login authenticator failed for H=(js9LcfDe) [2.58.56.77]:64768: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:55:32 dovecot_login authenticator failed for H=(yk4NR6kAmL) [158.94.208.175]:55761: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:56:25 dovecot_login authenticator failed for H=(TXlBH9) [178.16.54.22]:60582: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.208
country_id: 732800
description:
2026-01-31 19:56:41 dovecot_login authenticator failed for H=(151.237.115.208.pronet.bg) [151.237.115.208]:36608: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 19:57:01 H=([167.148.167.71]) [167.148.167.71]:52539 F=<Support@euratech.com.my> rejected RCPT <olivia@euratech.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:56:07 dovecot_login authenticator failed for H=(tmX5zomQh) [2.58.56.77]:61090: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:56:12 dovecot_login authenticator failed for H=(mw6bQ0Ee4X) [158.94.208.175]:64779: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-01-31 19:56:31 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:42806: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.75.243.5
country_id: 1814991
description:
2026-01-31 19:57:50 dovecot_login authenticator failed for H=([111.75.243.5]) [111.75.243.5]:33628: 535 Incorrect authentication data (set_id=noreply@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:57:13 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:56069: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:57:15 dovecot_login authenticator failed for H=(94l0YDzj) [2.58.56.77]:53234: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:57:32 dovecot_login authenticator failed for H=(Wkk0Xe) [158.94.208.175]:51587: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:57:35 dovecot_login authenticator failed for H=(dIr6RkYo) [178.16.54.22]:53948: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.40.114.86
country_id: 1835841
description:
2026-01-31 19:57:11 dovecot_login authenticator failed for H=([14.40.114.86]) [14.40.114.86]:58082: 535 Incorrect authentication data (set_id=noreply@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/img/img/demos/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:58:47 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:52038: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:58:04 dovecot_login authenticator failed for H=(OfissSjb) [158.94.208.175]:63708: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.84.209.188
country_id: 1814991
description:
2026-01-31 19:58:04 dovecot_login authenticator failed for H=([117.40.175.86]) [223.84.209.188]:46646: 535 Incorrect authentication data (set_id=noreply)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:58:06 dovecot_login authenticator failed for H=(SZD9Fp0njA) [178.16.54.22]:57160: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:58:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:58:03 dovecot_login authenticator failed for H=(ryBhjzbG) [2.58.56.77]:50625: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 19:58:11 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:51000: 535 Incorrect authentication data (set_id=testing@mams1.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.193.128.82
country_id: 1269750
description:
2026-01-31 20:00:00 dovecot_login authenticator failed for H=(nsg-corporate-6.249.186.122.airtel.in) [116.193.128.82]:54026: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
country_id: 1835841
description:
2026-01-31 19:59:08 dovecot_login authenticator failed for H=([175.206.113.91]) [175.206.113.91]:49784: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 19:59:09 dovecot_login authenticator failed for H=(Hy5jLd) [2.58.56.77]:52694: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.132.29.166
country_id: 2233387
description:
2026-01-31 19:59:18 dovecot_login authenticator failed for H=(host-129.0.111.246.mtn.cm) [102.132.29.166]:54793: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-01-31 19:59:37 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:48070: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.47.46.174
country_id: 1522867
description:
2026-01-31 19:59:28 dovecot_login authenticator failed for H=([92.47.46.174]) [92.47.46.174]:51818: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.137
country_id: 1835841
description:
2026-01-31 19:59:47 dovecot_login authenticator failed for H=([121.131.220.137]) [121.131.220.137]:45479: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 19:59:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 19:59:03 dovecot_login authenticator failed for H=(zRDZUigOo) [158.94.208.175]:56780: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 19:59:14 dovecot_login authenticator failed for H=(1ZG6isX) [178.16.54.22]:52294: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-31 20:00:40 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:45531: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 20:00:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-01-31 20:00:36 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:48698: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:00:14 dovecot_login authenticator failed for H=(HeDRDfJ) [158.94.208.175]:51509: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-01-31 20:00:15 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:43034: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 20:00:25 dovecot_login authenticator failed for H=(AVVvPY49hb) [45.94.31.131]:61731: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 20:00:08 dovecot_login authenticator failed for H=(eY2RL2m) [178.16.54.22]:62251: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.165.21.246
country_id: 1814991
description:
2026-01-31 20:00:57 dovecot_login authenticator failed for H=([180.165.21.246]) [180.165.21.246]:41242: 535 Incorrect authentication data (set_id=noreply)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 31 20:00:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@kdiballoon.com has been locked for the attacker IP 178.16.54.22


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.168.148
country_id: 337996
description:
2026-01-31 20:00:36 dovecot_login authenticator failed for H=([196.188.168.148]) [196.188.168.148]:39752: 535 Incorrect authentication data (set_id=noreply@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 20:00:15 dovecot_login authenticator failed for H=(gAIB2UKa) [2.58.56.77]:62084: 535 Incorrect authentication data (set_id=spyong)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 20:01:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 20:01:23 dovecot_login authenticator failed for H=(dTiXWX) [2.58.56.77]:59669: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.140
country_id: 1835841
description:
2026-01-31 20:01:34 dovecot_login authenticator failed for H=([120.29.140.140]) [120.29.140.140]:50593: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:01:15 dovecot_login authenticator failed for H=(btf2MVXX) [158.94.208.175]:56876: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.36.223.102
country_id: 1814991
description:
2026-01-31 20:01:23 dovecot_login authenticator failed for H=([103.36.223.102]) [103.36.223.102]:35167: 535 Incorrect authentication data (set_id=noreply)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 31 20:01:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@kdiballoon.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2026-01-31 20:01:27 dovecot_login authenticator failed for H=([122.187.230.227]) [122.187.230.227]:58371: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.4.199.164
country_id: 1814991
description:
2026-01-31 20:01:30 dovecot_login authenticator failed for H=([122.4.199.164]) [122.4.199.164]:51446: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 20:01:05 dovecot_login authenticator failed for H=(9AdpRSl) [45.94.31.131]:57375: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 20:01:26 dovecot_login authenticator failed for H=(wNt1mOQXv) [178.16.54.22]:60213: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-31 20:01:37 H=([45.144.212.50]) [45.144.212.50]:61574 F=<ccmsservice@bangkokbank.com> rejected RCPT <mustapa@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from bangkokbank.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-01-31 20:01:42 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:33198: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 20:02:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-01-31 20:02:24 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:52826: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 1.178.219.31
country_id: 6254930
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/steam/43/451633 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-01-31 20:02:12 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 20:02:15 dovecot_login authenticator failed for H=(KaCcmDSIYh) [178.16.54.22]:55943: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:02:20 dovecot_login authenticator failed for H=(qWGpcL0YuT) [158.94.208.175]:56269: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:02:30 dovecot_login authenticator failed for H=(BoaYMXgEfA) [158.94.208.175]:55589: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 31 20:02:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@kdiballoon.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 20:02:05 dovecot_login authenticator failed for H=(vSRGw7) [45.94.31.131]:61364: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 20:02:09 dovecot_login authenticator failed for H=(Kz5py6) [2.58.56.77]:49189: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.253.25.216
country_id: 3469034
description:
2026-01-31 20:02:15 dovecot_plain authenticator failed for H=(Q171B58071) [191.253.25.216]:10458: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 20:03:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:03:15 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:49477: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 20:03:13 dovecot_login authenticator failed for H=(e6w80U) [2.58.56.77]:51965: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2026-01-31 20:03:56 dovecot_login authenticator failed for H=([183.182.99.92]) [183.182.99.92]:50081: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 20:03:05 dovecot_login authenticator failed for H=(MDbEyZ) [45.94.31.131]:59146: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.58
country_id: 1814991
description:
2026-01-31 20:03:40 dovecot_login authenticator failed for H=([111.61.176.58]) [111.61.176.58]:11788: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 31 20:03:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@kdiballoon.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-31 20:03:31 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:64263: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:03:13 dovecot_login authenticator failed for H=(OR4BxmpP) [158.94.208.175]:58679: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.230.184
country_id: 1814991
description:
2026-01-31 20:03:13 dovecot_login authenticator failed for H=([60.172.230.184]) [60.172.230.184]:54440: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 20:03:04 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:27116: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.222
country_id: 1819730
description:
2026-01-31 20:03:06 dovecot_login authenticator failed for H=222.42.246.220.static.netvigator.com [220.246.42.222]:62584: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-31 20:03:50 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:35114: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.244
country_id: 1814991
description:
2026-01-31 20:03:48 dovecot_login authenticator failed for H=([111.61.176.244]) [111.61.176.244]:51628: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 20:03:05 dovecot_login authenticator failed for H=(YaiwRn3) [178.16.54.22]:64011: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 20:03:31 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:53126: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 20:04:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:04:13 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:56745: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 20:04:15 dovecot_login authenticator failed for H=(DSt1O3d) [2.58.56.77]:51387: 535 Incorrect authentication data (set_id=spyong)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/demos/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.165.53.7
country_id: 3865483
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/img/photos/7888952793.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:04:44 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:62148: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 20:04:38 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:55368: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 20:04:04 dovecot_login authenticator failed for H=(eIzD3Nb) [45.94.31.131]:51674: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:04:26 dovecot_login authenticator failed for H=(PbFwBpuTM) [158.94.208.175]:53524: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-31 20:04:28 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:41088: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.237.122.251
country_id: 99237
domain: plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/plomalite.com/images/welding.png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 20:05:21 dovecot_login authenticator failed for H=(pVsFC8SXRt) [2.58.56.77]:60321: 535 Incorrect authentication data (set_id=spyong)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.62.148.116
country_id: 99237
domain: plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/plomalite.com/images/3-3.png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:05:15 dovecot_login authenticator failed for H=(ApK5FXKSV6) [158.94.208.175]:61963: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.125.142
country_id: 99237
domain: plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/plomalite.com/images/c-68.png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 20:05:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.1.108.169
country_id: 99237
domain: plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/plomalite.com/images/Cabe website 07072021 without bg grid (PNG).png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.85.27.190
country_id: 3865483
domain: plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/plomalite.com/images/Cabe-Website-Photo-v1.png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 20:05:02 dovecot_login authenticator failed for H=(FNTfhQHDC) [45.94.31.131]:56649: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:06:13 dovecot_login authenticator failed for H=(eAFTbM) [158.94.208.175]:64824: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 20:06:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 20:06:22 dovecot_login authenticator failed for H=(5P4qHG4Gr) [45.94.31.131]:63391: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.71.214.155
country_id: 6252001
description:
2026-01-31 20:06:43 dovecot_login authenticator failed for H=wsip-174-71-214-155.lv.lv.cox.net [174.71.214.155]:51567: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 20:06:53 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.37.164.184
country_id: 3865483
domain: plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/plomalite.com/images/c-51.png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 20:06:10 dovecot_login authenticator failed for H=(QpQyjAdv) [2.58.56.77]:60876: 535 Incorrect authentication data (set_id=spyong)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.132.181.183
country_id: 1210997
domain: plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/plomalite.com/images/DBA Trophy.png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 20:07:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account spyong has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 20:07:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:07:21 dovecot_login authenticator failed for H=(3toIunZnp3) [158.94.208.175]:58802: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 20:07:22 dovecot_login authenticator failed for H=(JouIZs50) [45.94.31.131]:65524: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 20:07:17 dovecot_login authenticator failed for H=(Vt5cET) [2.58.56.77]:56631: 535 Incorrect authentication data (set_id=spyong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-01-31 20:07:36 dovecot_login authenticator failed for H=(6NEhkJ) [146.70.146.50]:61076: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 20:08:20 dovecot_login authenticator failed for H=(iRAuBh14) [45.94.31.131]:56947: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:08:18 dovecot_login authenticator failed for H=(ii32bbfZe2) [158.94.208.175]:65090: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:08:34 dovecot_login authenticator failed for H=(JEc8xzW5Yi) [158.94.208.175]:56180: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.108.174.16
country_id: 1269750
description:
2026-01-31 20:08:09 dovecot_login authenticator failed for H=(ADMIN) [103.108.174.16]:50349: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-01-31 20:08:17 dovecot_login authenticator failed for H=(F99oBE) [146.70.146.50]:50193: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/about-sinaran-utama-teknologi/images/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-01-31 20:08:42 51528 [Warning] Aborted connection 51528 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:09:04 dovecot_login authenticator failed for H=(7uD4842JwC) [158.94.208.175]:55750: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/images/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-01-31 20:09:39 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:36555: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 20:09:17 dovecot_login authenticator failed for H=(MdnhhKPp) [45.94.31.131]:52601: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.123.109.43
country_id: 732800
description:
2026-01-31 20:09:07 dovecot_login authenticator failed for H=(ADMIN) [93.123.109.43]:33868: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:09:25 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:60488: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-31 20:09:43 H=([45.144.212.50]) [45.144.212.50]:57877 F=<ccmsservice@bangkokbank.com> rejected RCPT <celine@ktlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from bangkokbank.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.105.22
country_id: 2363686
description:
2026-01-31 20:10:51 dovecot_plain authenticator failed for H=(738K4S3IJ) [196.171.105.22]:63412: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-01-31 20:10:17 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:38808: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-31 20:10:18 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:43286: 535 Incorrect authentication data (set_id=seanlee@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:10:18 dovecot_login authenticator failed for H=(WJOlPfM3e) [158.94.208.175]:52127: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-01-31 20:10:39 dovecot_login authenticator failed for H=(c90gyso) [146.70.146.50]:63345: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.108
country_id: 1814991
description:
2026-01-31 20:10:43 dovecot_login authenticator failed for H=([111.61.97.108]) [111.61.97.108]:29052: 535 Incorrect authentication data (set_id=seanlee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:10:09 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63597: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.46.68.9
country_id: 1643084
description:
2026-01-31 20:10:09 dovecot_plain authenticator failed for H=(ZZ7H17CIG) [202.46.68.9]:35068: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 20:10:14 dovecot_login authenticator failed for H=(28n21vSb) [45.94.31.131]:63111: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 20:11:30 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 20:11:12 dovecot_login authenticator failed for H=(N3jRBE9G) [45.94.31.131]:61979: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-01-31 20:11:22 dovecot_login authenticator failed for H=(c4ZFvT) [146.70.146.50]:50440: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/images/sliders/eco.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.15
country_id: 1733045
description:
2026-01-31 20:11:43 dovecot_login authenticator failed for H=([49.124.153.15]) [49.124.153.15]:40338: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 20:11:51 H=([167.148.167.71]) [167.148.167.71]:52589 F=<Support@cordage.com.my> rejected RCPT <purchasing@cordage.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.49.97.15
country_id: 6252001
description:
2026-01-31 20:11:53 dovecot_login authenticator failed for H=(64-49-97-15.protekweb.com) [64.49.97.15]:48718: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:11:04 dovecot_login authenticator failed for H=(s6NZsKdRz) [158.94.208.175]:57681: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:11:16 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:50126: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 20:12:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-31 20:12:45 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:65295: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-01-31 20:13:02 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:33000: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:12:10 dovecot_login authenticator failed for H=(rrSsj1) [158.94.208.175]:51606: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-01-31 20:12:13 dovecot_login authenticator failed for H=(uSN0ZYyN) [146.70.146.50]:64652: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 20:12:13 dovecot_login authenticator failed for H=(jfD3KN8) [45.94.31.131]:50610: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 20:13:14 dovecot_login authenticator failed for H=(pIlkZvX5) [45.94.31.131]:57498: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:13:10 dovecot_login authenticator failed for H=(MMeb1uSDF) [158.94.208.175]:52853: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: aircarbonic.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/aircarbonicadmin/public_html/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.188
country_id: 1814991
description:
2026-01-31 20:13:32 dovecot_login authenticator failed for H=([111.61.177.188]) [111.61.177.188]:12382: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 20:13:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 1.178.208.107
country_id: 6254930
description:
Jan 31 20:14:32 sv3 pure-ftpd[225166]: (?@1.178.208.107) [WARNING] Authentication failed for user [sham@dsc-expat.com]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:14:05 dovecot_login authenticator failed for H=(dbMQQy) [158.94.208.175]:57781: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 20:14:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 20:14:13 dovecot_login authenticator failed for H=(WZkghCuYfo) [45.94.31.131]:53264: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.178.208.107
country_id: 6254930
description:
2026-01-31 20:14:39 dovecot_plain authenticator failed for H=([127.0.1.1]) [1.178.208.107]:46048: 535 Incorrect authentication data (set_id=sham@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.75.24.242
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/img/img/demos/img/demos/img/photos/news.php||SC:/home2/pspolycom/public_html/img/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.155.118.195
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=449403 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.208.65.46
country_id: 2017370
description:
2026-01-31 20:14:04 dovecot_login authenticator failed for H=(est.giport.ru) [82.208.65.46]:3862: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-31 20:14:16 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:46280: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.58.129.9
country_id: 895949
description:
2026-01-31 20:15:26 dovecot_plain authenticator failed for H=(E7G74M1Q) [165.58.129.9]:44750: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.247.58
country_id: 3469034
description:
2026-01-31 20:15:16 dovecot_login authenticator failed for H=([186.238.157.140]) [187.9.247.58]:55231: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:15:24 dovecot_login authenticator failed for H=(zeUIPUT) [158.94.208.175]:51254: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2026-01-31 20:15:31 dovecot_login authenticator failed for H=(163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:34328: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-01-31 20:15:01 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:32966: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.93.201.42
country_id: 1269750
description:
2026-01-31 20:15:02 dovecot_login authenticator failed for H=([103.93.201.42]) [103.93.201.42]:41457: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 20:15:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:15:08 dovecot_login authenticator failed for H=(RKLkbU) [158.94.208.175]:55268: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 20:15:13 dovecot_login authenticator failed for H=(ImpI2LKF) [45.94.31.131]:65477: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 20:15:42 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:56590: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.243.58
country_id: 1814991
description:
2026-01-31 20:16:13 dovecot_login authenticator failed for H=([218.21.243.58]) [218.21.243.58]:44498: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-31 20:16:24 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:45681: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 20:16:49 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:55482: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:16:07 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:51904: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:16:10 dovecot_login authenticator failed for H=(PJE42n8) [158.94.208.175]:57204: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 20:16:14 dovecot_login authenticator failed for H=(0i5T9N) [45.94.31.131]:51979: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.154.143
country_id: 337996
description:
2026-01-31 20:16:19 dovecot_plain authenticator failed for H=(15WC133) [196.189.154.143]:1938: 535 Incorrect authentication data (set_id=jasonkua@printspecsolution.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-01-31 20:16:41 dovecot_login authenticator failed for H=([175.180.129.87]) [175.180.129.87]:46426: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 20:17:14 dovecot_login authenticator failed for H=(8bmoyvhqm5) [45.94.31.131]:60840: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.54.150
country_id: 1814991
description:
2026-01-31 20:17:58 dovecot_login authenticator failed for H=([61.169.54.150]) [61.169.54.150]:57763: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.54.40
country_id: 453733
description:
2026-01-31 20:17:09 dovecot_login authenticator failed for H=40-54-166-83.dyn.estpak.ee [83.166.54.40]:58149: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.95.198.138
country_id: 1269750
description:
2026-01-31 20:17:24 dovecot_login authenticator failed for H=(dsl-kk-static-static-138.198.95.61.airtelbroadband.in) [61.95.198.138]:35388: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:17:06 dovecot_login authenticator failed for H=(LUD5qpjy) [158.94.208.175]:60382: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-01-31 20:17:26 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:47200: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.42.190.241
country_id: 6252001
description:
2026-01-31 20:17:42 dovecot_login authenticator failed for H=host241.sub-63-42-190.myvzw.com [63.42.190.241]:54963: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.194
country_id: 1269750
description:
2026-01-31 20:17:51 dovecot_login authenticator failed for H=(nsg-corporate-194.230.187.122.airtel.in) [122.187.230.194]:52390: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.72.93.189
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=913007 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:17:21 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:61135: 535 Incorrect authentication data (set_id=test@mams1.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:18:13 dovecot_login authenticator failed for H=(6hbdlOzV) [158.94.208.175]:59489: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.201.52
country_id: 1814991
description:
2026-01-31 20:18:27 dovecot_login authenticator failed for H=([58.16.201.52]) [58.16.201.52]:41760: 535 Incorrect authentication data (set_id=ysl)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 149.50.97.212
country_id: 798544
domain: fkr.com.my
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:grub-client-1.5.3; (grub-client-1.5.3; Crawl your own stuff with http://grub.org)||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:18:03 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:59677: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 20:18:14 dovecot_login authenticator failed for H=(BGvFN6kJFA) [45.94.31.131]:58105: 535 Incorrect authentication data (set_id=celine)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.147.206.125
country_id: 1210997
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=41951515122758 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.116.165
country_id: 3144096
description:
2026-01-31 20:18:17 dovecot_login authenticator failed for H=(cm-178.232.116.165.get.no) [178.232.116.165]:36175: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:19:22 dovecot_login authenticator failed for H=(2DzI26bTs) [158.94.208.175]:57507: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 20:19:15 dovecot_login authenticator failed for H=(c2k2hZ64) [45.94.31.131]:65460: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.188
country_id: 1814991
description:
2026-01-31 20:19:24 dovecot_login authenticator failed for H=([111.61.177.188]) [111.61.177.188]:29152: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 20:19:34 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.10.98.29
country_id: 1643084
description:
[2026-01-31 20:20:45 +0800] info [cpaneld] 182.10.98.29 - kimmark "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:20:08 dovecot_login authenticator failed for H=(x3IvuMw) [158.94.208.175]:65509: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
country_id: 1814991
description:
2026-01-31 20:20:08 dovecot_login authenticator failed for H=([116.113.254.26]) [116.113.254.26]:40024: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.168.71.109
country_id: 1835841
description:
2026-01-31 20:21:56 dovecot_login authenticator failed for H=([112.168.71.109]) [112.168.71.109]:45122: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:21:20 dovecot_login authenticator failed for H=(X3sDrX) [158.94.208.175]:54061: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.211.59.76
country_id: 2328926
description:
2026-01-31 20:21:52 dovecot_login authenticator failed for H=(XStotbG8L) [197.211.59.76]:32372: 535 Incorrect authentication data (set_id=nicholas@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.199.216.242
country_id: 2017370
description:
2026-01-31 20:22:10 dovecot_login authenticator failed for H=(static-217-199-216-242.tel.ru) [217.199.216.242]:54529: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.172.15.103
country_id: 3469034
description:
2026-01-31 20:22:21 dovecot_login authenticator failed for H=(177-172-15-62.user.vivozap.com.br) [177.172.15.103]:57947: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:22:34 dovecot_login authenticator failed for H=(Nk5NpKFc) [158.94.208.175]:59775: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.211.59.76
country_id: 2328926
description:
2026-01-31 20:22:04 dovecot_login authenticator failed for H=(Irni3qE7a) [197.211.59.76]:32373: 535 Incorrect authentication data (set_id=nicholas@kendek.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:22:05 dovecot_login authenticator failed for H=(9o5UFLA7Xz) [158.94.208.175]:60740: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.249.7.12
country_id: 953987
description:
2026-01-31 20:23:01 dovecot_plain authenticator failed for H=8ta-249-7-12.telkomadsl.co.za (P1G39) [102.249.7.12]:46180: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 139.59.113.221
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.71||T:APACHE||MV:/blog/wp-json/wp/v2/users/||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:23:27 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:54146: 535 Incorrect authentication data (set_id=testing@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.211.59.76
country_id: 2328926
description:
2026-01-31 20:23:12 dovecot_login authenticator failed for H=(rORHsV) [197.211.59.76]:32376: 535 Incorrect authentication data (set_id=nicholas@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:23:22 dovecot_login authenticator failed for H=(VzbqJu6) [158.94.208.175]:58679: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:24:05 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:52905: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:24:19 dovecot_login authenticator failed for H=(eMnayG) [158.94.208.175]:56668: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.242.201.229
country_id: 298795
description:
2026-01-31 20:24:39 dovecot_login authenticator failed for H=([178.242.201.229]) [178.242.201.229]:48748: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 20:24:45 dovecot_login authenticator failed for H=(jDoTlUqdMT) [137.220.199.220]:64575: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:24:50 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:57226: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 139.59.113.221
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Special shell symbol in request||MV:{@Banyuanyar2022@}||MVN:ARGS:pwd||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2026-01-31 20:24:50 dovecot_login authenticator failed for H=(189-56-0-19.customer.tdatabrasil.net.br) [189.56.0.19]:45201: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 20:25:05 dovecot_login authenticator failed for H=(y8d4OV) [137.220.199.220]:64885: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.123.219.82
country_id: 6252001
description:
2026-01-31 20:25:10 dovecot_login authenticator failed for H=ool-457bdb52.dyn.optonline.net [69.123.219.82]:39545: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-01-31 20:25:14 dovecot_login authenticator failed for H=([175.180.129.87]) [175.180.129.87]:39476: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:25:41 dovecot_login authenticator failed for H=(QXuY4aSteo) [158.94.208.175]:52895: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.104
country_id: 1269750
description:
2026-01-31 20:25:43 dovecot_login authenticator failed for H=(nsg-corporate-104.230.187.122.airtel.in) [122.187.230.104]:45096: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/images/radioactive.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 20:25:51 H=([167.148.167.71]) [167.148.167.71]:51842 F=<Support@euratech.com.my> rejected RCPT <rohaidaak@euratech.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 20:26:20 dovecot_login authenticator failed for H=(lxgrTCr1X) [137.220.199.220]:50176: 535 Incorrect authentication data (set_id=png-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:26:22 dovecot_login authenticator failed for H=(MyG8AH) [158.94.208.175]:54508: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.54.70.29
country_id: 1512440
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/good/446/482990 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 20:27:53 dovecot_login authenticator failed for H=(G8OHSu) [137.220.199.220]:53001: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:27:35 dovecot_login authenticator failed for H=(1JmONw83m) [158.94.208.175]:53176: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 20:27:12 H=([167.148.167.71]) [167.148.167.71]:58344 F=<Support@af-sb.com> rejected RCPT <roz@af-sb.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 20:27:17 dovecot_login authenticator failed for H=(8zy7Q2b) [137.220.199.220]:51577: 535 Incorrect authentication data (set_id=png-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 20:27:25 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:50453: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.220.97.188
country_id: 6252001
description:
2026-01-31 20:28:37 dovecot_login authenticator failed for H=c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:39550: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:28:11 dovecot_login authenticator failed for H=(shAorQg9) [158.94.208.175]:62077: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 20:28:06 dovecot_login authenticator failed for H=(p4zCsHM67) [137.220.199.220]:53169: 535 Incorrect authentication data (set_id=png-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.149
country_id: 1733045
description:
2026-01-31 20:28:25 dovecot_login authenticator failed for H=([49.124.152.149]) [49.124.152.149]:52170: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.116.107.222
country_id: 1835841
description:
2026-01-31 20:28:22 dovecot_login authenticator failed for H=([211.116.107.222]) [211.116.107.222]:33070: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/img/photos/services.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 20:28:38 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:61003: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 20:28:57 dovecot_login authenticator failed for H=(lyavuJoOEl) [137.220.199.220]:54603: 535 Incorrect authentication data (set_id=png-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.166
country_id: 1269750
description:
2026-01-31 20:28:58 dovecot_login authenticator failed for H=([182.95.185.166]) [182.95.185.166]:56292: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:29:07 dovecot_login authenticator failed for H=(Vz8ZEuL6AN) [158.94.208.175]:59846: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2026-01-31 20:29:20 dovecot_login authenticator failed for H=(46.30.161.197.access.ipnet.ua) [46.30.161.197]:50466: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-31 20:29:43 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:36760: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.122.215.23
country_id: 6252001
description:
2026-01-31 20:29:34 dovecot_login authenticator failed for H=(syn-098-122-215-023.res.spectrum.com) [98.122.215.23]:42994: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
country_id: 2750405
description:
2026-01-31 20:29:02 dovecot_login authenticator failed for H=ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:56916: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.247.43.42
country_id: 2017370
description:
2026-01-31 20:29:43 dovecot_login authenticator failed for H=([188.247.43.42]) [188.247.43.42]:60248: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:30:02 dovecot_login authenticator failed for H=(KgNGhrfqk) [158.94.208.175]:61560: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:30:05 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:58384: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 139.59.113.221
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Special shell symbol in request||MV:{@Pakuniran2023@}||MVN:ARGS:pwd||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.10.20
country_id: 1814991
description:
2026-01-31 20:30:51 dovecot_login authenticator failed for H=([221.10.10.20]) [221.10.10.20]:47035: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:31:51 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63974: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:31:05 dovecot_login authenticator failed for H=(NLw9y4) [158.94.208.175]:52697: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.214.169.10
country_id: 2510769
description:
2026-01-31 20:31:18 dovecot_plain authenticator failed for H=(icatives) [185.214.169.10]:40759: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:31:13 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:49210: 535 Incorrect authentication data (set_id=test@sv3.nocser.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:32:07 dovecot_login authenticator failed for H=(PqQUlg34) [158.94.208.175]:51340: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.161
country_id: 2750405
description:
2026-01-31 20:33:03 60088 [Warning] Aborted connection 60088 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.161' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:33:13 dovecot_login authenticator failed for H=(l2VtCy) [158.94.208.175]:59163: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:34:23 dovecot_login authenticator failed for H=(EuGBDKY3) [158.94.208.175]:52494: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.30.124.96
country_id: 1814991
description:
2026-01-31 20:34:31 dovecot_login authenticator failed for H=(dns58.online.tj.cn) [111.30.124.96]:15017: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-31 20:34:41 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:37358: 535 Incorrect authentication data (set_id=aziz)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.64.215
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=836901 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.152
country_id: 1269750
description:
2026-01-31 20:35:05 dovecot_login authenticator failed for H=(nsg-corporate-152.227.187.122.airtel.in) [122.187.227.152]:53727: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-01-31 20:35:39 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:34976: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2026-01-31 20:35:23 dovecot_login authenticator failed for H=([200.148.171.233]) [189.56.0.19]:39717: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.161
country_id: 2750405
description:
2026-01-31 20:35:50 62355 [Warning] Aborted connection 62355 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.161' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-01-31 20:35:07 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:46498: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:35:10 dovecot_login authenticator failed for H=(wUyhXRqHsa) [158.94.208.175]:52458: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.202.130.254
country_id: 6252001
description:
[2026-01-31 20:37:00 +0800] info [cpaneld] 71.202.130.254 - mymetalcom "GET /login/?login_only=1&user=mymetalcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mymetalcom (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:36:19 dovecot_login authenticator failed for H=(MN0zAJj) [158.94.208.175]:59799: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.198.61.146
country_id: 1814991
description:
2026-01-31 20:36:32 dovecot_login authenticator failed for H=([120.198.61.146]) [120.198.61.146]:38512: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.214.209.126
country_id: 6252001
description:
[2026-01-31 20:36:43 +0800] info [cpaneld] 97.214.209.126 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 15.204.94.173
country_id: 6252001
description:
2026-01-31 20:36:22 dovecot_login authenticator failed for H=vps-63db5216.vps.ovh.us [15.204.94.173]:38170: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.182.55.193
country_id: 6252001
description:
[2026-01-31 20:36:50 +0800] info [cpaneld] 174.182.55.193 - mymetalcommy "GET /login/?login_only=1&user=mymetalcommy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mymetalcommy (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.113.193
country_id: 2960313
description:
2026-01-31 20:36:52 dovecot_login authenticator failed for H=(ADMIN) [37.46.113.193]:26454: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.189.144.204
country_id: 6252001
description:
[2026-01-31 20:36:52 +0800] info [cpaneld] 67.189.144.204 - mymetalcomm "GET /login/?login_only=1&user=mymetalcomm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mymetalcomm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.223.193.149
country_id: 6252001
description:
[2026-01-31 20:37:19 +0800] info [cpaneld] 216.223.193.149 - myme "GET /login/?login_only=1&user=myme&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user myme (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.206.142.211
country_id: 6252001
description:
[2026-01-31 20:37:28 +0800] info [cpaneld] 71.206.142.211 - mymetal1 "GET /login/?login_only=1&user=mymetal1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mymetal1 (has_cpuser_file failed)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:37:05 dovecot_login authenticator failed for H=(a2eRZPHl1) [158.94.208.175]:53720: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.159.198.217
country_id: 6252001
description:
[2026-01-31 20:37:10 +0800] info [cpaneld] 73.159.198.217 - mymeta "GET /login/?login_only=1&user=mymeta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mymeta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.219.190.162
country_id: 6252001
description:
[2026-01-31 20:37:22 +0800] info [cpaneld] 74.219.190.162 - mym "GET /login/?login_only=1&user=mym&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mym (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:37:36 dovecot_login authenticator failed for H=(D4KoMjwrMV) [158.94.208.175]:61380: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2026-01-31 20:37:51 dovecot_login authenticator failed for H=([185.134.179.106]) [185.101.16.250]:56070: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.174.104.139
country_id: 6252001
description:
[2026-01-31 20:37:05 +0800] info [cpaneld] 73.174.104.139 - mymetalc "GET /login/?login_only=1&user=mymetalc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mymetalc (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.44.0.185
country_id: 2017370
description:
2026-01-31 20:37:23 dovecot_login authenticator failed for H=([46.44.0.185]) [46.44.0.185]:58118: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.200.178.7
country_id: 6252001
description:
[2026-01-31 20:37:25 +0800] info [cpaneld] 97.200.178.7 - my "GET /login/?login_only=1&user=my&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user my (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.170.163.201
country_id: 6252001
description:
[2026-01-31 20:37:15 +0800] info [cpaneld] 174.170.163.201 - mymet "GET /login/?login_only=1&user=mymet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mymet (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.198.168.228
country_id: 1269750
description:
2026-01-31 20:37:16 dovecot_login authenticator failed for H=([103.250.160.76]) [117.198.168.228]:47176: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.237.177.239
country_id: 1562822
description:
2026-01-31 20:38:05 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [171.237.177.239]:31118: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:38:04 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:55497: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.114.73
country_id: 1168579
description:
2026-01-31 20:38:24 dovecot_login authenticator failed for H=([103.186.114.73]) [103.186.114.73]:42499: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:38:10 dovecot_login authenticator failed for H=(2YbDh6S0G) [158.94.208.175]:61381: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2026-01-31 20:38:21 dovecot_login authenticator failed for H=([152.52.246.178]) [152.52.246.178]:45848: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.116.66
country_id: 1269750
description:
2026-01-31 20:38:32 dovecot_login authenticator failed for H=([182.95.116.66]) [182.95.116.66]:49920: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.164
country_id: 1269750
description:
2026-01-31 20:38:52 dovecot_login authenticator failed for H=(nsg-corporate-164.227.187.122.airtel.in) [122.187.227.164]:32987: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.204.125.124
country_id: 1835841
description:
2026-01-31 20:38:34 dovecot_login authenticator failed for H=([119.204.125.124]) [119.204.125.124]:50283: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.142.48.143
country_id: 2017370
description:
2026-01-31 20:38:40 dovecot_login authenticator failed for H=(213.142.48.143-FTTB.planeta.tc) [213.142.48.143]:44676: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.231.20.54
country_id: 2017370
description:
2026-01-31 20:39:06 dovecot_login authenticator failed for H=([62.231.20.54]) [62.231.20.54]:60790: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.114
country_id: 1269750
description:
2026-01-31 20:39:18 dovecot_login authenticator failed for H=(aes-static-065.58.246.61.airtel.in) [182.95.184.114]:41446: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:39:56 dovecot_login authenticator failed for H=(kyWcRwtpZs) [158.94.208.175]:57842: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.42.37
country_id: 1668284
description:
2026-01-31 20:39:36 dovecot_login authenticator failed for H=111-70-42-37.emome-ip.hinet.net [111.70.42.37]:59342: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:39:11 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:61478: 535 Incorrect authentication data (set_id=testing@mams1.manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:39:54 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64112: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 20:40:17 H=([167.148.167.71]) [167.148.167.71]:51480 F=<Support@hmz.com.my> rejected RCPT <sales@hmz.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:40:26 dovecot_login authenticator failed for H=(wZ0z1f) [158.94.208.175]:58888: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 20:40:23 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:63619: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.237.134
country_id: 1269750
description:
2026-01-31 20:41:52 dovecot_login authenticator failed for H=([182.95.26.150]) [125.23.237.134]:41890: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:41:09 dovecot_login authenticator failed for H=(8KzS6I) [158.94.208.175]:52931: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.180.19
country_id: 337996
description:
2026-01-31 20:41:43 dovecot_login authenticator failed for H=([196.190.180.18]) [196.190.180.19]:14027: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.204.232.244
country_id: 1269750
description:
2026-01-31 20:42:12 dovecot_login authenticator failed for H=(broadband.actcorp.in) [49.204.232.244]:60356: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.222.43.121
country_id: 6251999
description:
2026-01-31 20:42:01 dovecot_plain authenticator failed for H=academiadeseguridad.com (huy2u0xxlfquy37xtclxltcty5sokd) [51.222.43.121]:34442: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.33.47.2
country_id: 1835841
description:
2026-01-31 20:42:05 dovecot_login authenticator failed for H=([118.33.47.2]) [118.33.47.2]:42412: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.161
country_id: 2750405
description:
2026-01-31 20:42:05 76067 [Warning] Aborted connection 76067 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.161' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.85.14.208
country_id: 6252001
description:
2026-01-31 20:42:01 dovecot_login authenticator failed for H=([107.85.14.208]) [107.85.14.208]:48859: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:42:13 dovecot_login authenticator failed for H=(IY65Dxr) [158.94.208.175]:62298: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:43:01 dovecot_login authenticator failed for H=(pn2rYMA) [158.94.208.175]:49286: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 139.59.113.221
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Special shell symbol in request||MV:{@Wonomerto2023@}||MVN:ARGS:pwd||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.181.110.221
country_id: 99237
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=124214 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 20:43:16 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:58599: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.198.131.40
country_id: 6252001
description:
2026-01-31 20:43:10 dovecot_plain authenticator failed for H=([124.198.131.40]) [124.198.131.40]:50055: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-01-31 20:43:33 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:51267: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2026-01-31 20:44:20 dovecot_login authenticator failed for H=([80.227.147.94]) [80.227.147.94]:37590: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:44:40 dovecot_login authenticator failed for H=(bEUbyljsE) [158.94.208.175]:64963: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.36.194.248
country_id: 1814991
description:
2026-01-31 20:44:52 dovecot_login authenticator failed for H=([119.36.193.230]) [119.36.194.248]:50740: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-01-31 20:44:54 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:47786: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:44:11 dovecot_login authenticator failed for H=(C6MV5RCWCG) [158.94.208.175]:53950: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:44:21 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63725: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:45:08 dovecot_login authenticator failed for H=(bhqJKxI) [158.94.208.175]:65138: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.216.165.187
country_id: 2017370
description:
2026-01-31 20:45:14 dovecot_login authenticator failed for H=([178.216.165.187]) [178.216.165.187]:57760: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.179.251
country_id: 99237
description:
2026-01-31 20:45:05 dovecot_login authenticator failed for H=([65.20.179.251]) [65.20.179.251]:45290: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:45:16 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:62992: 535 Incorrect authentication data (set_id=test@wcc.wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.13
country_id: 1733045
description:
2026-01-31 20:45:04 dovecot_login authenticator failed for H=([49.124.153.13]) [49.124.153.13]:40868: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.156.1.127
country_id: 3469034
description:
2026-01-31 20:46:06 dovecot_login authenticator failed for H=([38.156.1.127]) [38.156.1.127]:60960: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.31.93.229
country_id: 1814991
description:
2026-01-31 20:46:24 dovecot_login authenticator failed for H=([112.31.93.229]) [112.31.93.229]:60149: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.245
country_id: 1668284
description:
2026-01-31 20:46:48 dovecot_login authenticator failed for H=111-70-23-245.emome-ip.hinet.net [111.70.23.245]:35705: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.177.216
country_id: 1814991
description:
2026-01-31 20:46:56 dovecot_login authenticator failed for H=([111.26.177.215]) [111.26.177.216]:32922: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/fphortier/images/news.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 203.144.76.188
country_id: 1831722
description:
Jan 31 20:47:34 sv3 pure-ftpd[246817]: (?@203.144.76.188) [WARNING] Authentication failed for user [general]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.8.137.9
country_id: 2017370
description:
2026-01-31 20:47:50 dovecot_login authenticator failed for H=([194.8.137.9]) [194.8.137.9]:37585: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
country_id: 3469034
description:
2026-01-31 20:48:01 dovecot_login authenticator failed for H=([181.233.140.250]) [181.233.140.250]:34453: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:47:11 dovecot_login authenticator failed for H=(XYXPZQ4Y) [158.94.208.175]:58340: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 139.59.113.221
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Possible SQLi in arguments||MVN:ARGS:pwd||MV:himaktuunpad12345!@#$%||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.188
country_id: 1733045
description:
2026-01-31 20:47:08 dovecot_login authenticator failed for H=([49.124.159.188]) [49.124.159.188]:43462: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.86
country_id: 1269750
description:
2026-01-31 20:47:11 dovecot_login authenticator failed for H=([125.17.17.201]) [27.123.113.86]:59402: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.52.114
country_id: 1269750
description:
2026-01-31 20:47:35 dovecot_login authenticator failed for H=(nsg-corporate-255.223.187.122.airtel.in) [182.79.52.114]:54886: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-01-31 20:48:33 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:46306: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:48:41 dovecot_login authenticator failed for H=(sb4c63yqi) [158.94.208.175]:63977: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.143.201.18
country_id: 690791
description:
2026-01-31 20:48:05 dovecot_login authenticator failed for H=(host-18-201-143-83.reedlan.com) [83.143.201.18]:49160: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.41.224.132
country_id: 1269750
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/projects.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.73.174
country_id: 1814991
description:
2026-01-31 20:49:18 dovecot_login authenticator failed for H=(hebei.8.60.in-addr.arpa) [60.8.73.174]:50214: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-01-31 20:49:31 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:47406: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 20:49:35 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:59085: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:50:43 dovecot_login authenticator failed for H=(Zvb38p0A) [158.94.208.175]:54746: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2026-01-31 20:50:17 dovecot_login authenticator failed for H=([222.120.176.6]) [222.120.176.6]:57528: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.0.202
country_id: 2017370
description:
2026-01-31 20:51:04 dovecot_login authenticator failed for H=([83.239.0.202]) [83.239.0.202]:40848: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 20:51:09 H=([167.148.167.71]) [167.148.167.71]:59979 F=<Support@wohcheong.com.my> rejected RCPT <sales@wohcheong.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.145.5.14
country_id: 1835841
description:
2026-01-31 20:51:25 dovecot_login authenticator failed for H=([220.67.139.254]) [221.145.5.14]:45344: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:51:10 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:49745: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:51:15 dovecot_login authenticator failed for H=(ic8l0t6aMp) [158.94.208.175]:52229: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.39.178
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=22111523583801 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:52:24 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:55579: 535 Incorrect authentication data (set_id=testing@mams1.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:52:19 dovecot_login authenticator failed for H=(T4EIZ6pyO) [158.94.208.175]:56327: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:53:22 dovecot_login authenticator failed for H=(ZmT5el) [158.94.208.175]:65431: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 20:53:16 dovecot_login authenticator failed for H=(KMCNRb) [69.5.189.21]:51161: 535 Incorrect authentication data (set_id=bktan@printspecsolution.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:53:13 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63635: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 20:54:04 dovecot_login authenticator failed for H=(nALdCJ) [69.5.189.21]:59065: 535 Incorrect authentication data (set_id=bktan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 20:54:27 dovecot_login authenticator failed for H=(GjkZhE1) [158.94.208.175]:52024: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.44.130.122
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/mockery/mockery/docs/getting_started/index.rst HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 36.81.152.81
country_id: 1643084
domain: www.saps.com.my
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.71||T:APACHE||MV:/wp-json/wp/v2/users/me||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 20:54:24 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:53677: 535 Incorrect authentication data (set_id=testing@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 20:55:17 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:60277: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 20:55:13 dovecot_login authenticator failed for H=(Jx5NlAtn8M) [69.5.189.21]:54326: 535 Incorrect authentication data (set_id=bktan@printspecsolution.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.89.228.203
country_id: 1861060
domain: mail.mckd.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/mckd/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-31 20:56:50 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:42816: 535 Incorrect authentication data (set_id=sean@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 20:56:24 dovecot_login authenticator failed for H=(FqJbFv1) [69.5.189.21]:49754: 535 Incorrect authentication data (set_id=bktan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:57:54 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:59977: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2026-01-31 20:57:28 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:52302: 535 Incorrect authentication data (set_id=sean)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-01-31 20:57:33 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:57788: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:58:04 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:50412: 535 Incorrect authentication data (set_id=test@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.19.200.63
country_id: 660013
description:
2026-01-31 20:58:20 dovecot_login authenticator failed for H=([146.19.200.63]) [146.19.200.63]:33598: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2026-01-31 20:58:40 dovecot_login authenticator failed for H=(1522312565.colombiatel.co) [152.231.25.64]:52709: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.95
country_id: 1814991
description:
2026-01-31 20:58:54 dovecot_login authenticator failed for H=([27.24.141.95]) [27.24.141.95]:54808: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.92.202
country_id: 1269750
description:
2026-01-31 20:58:09 dovecot_login authenticator failed for H=([125.17.215.121]) [27.123.92.202]:36888: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.36.193.139
country_id: 1814991
description:
2026-01-31 20:58:39 dovecot_login authenticator failed for H=([119.36.194.248]) [119.36.193.139]:39768: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:59:37 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:55000: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 20:59:04 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:60707: 535 Incorrect authentication data (set_id=test@sv3.nocser.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2026-01-31 20:59:57 dovecot_login authenticator failed for H=(228.pool90-161-217.static.orange.es) [90.161.217.228]:35199: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.114
country_id: 1269750
description:
2026-01-31 20:59:10 dovecot_login authenticator failed for H=([182.95.184.114]) [182.95.184.114]:53494: 535 Incorrect authentication data (set_id=zainuddin)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.203.132.68
country_id: 2658434
domain: ahfengineering.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/ahfe3522/public_html/wp-admin/images/commentv.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.233.190
country_id: 1835841
description:
2026-01-31 20:59:28 dovecot_login authenticator failed for H=([106.10.69.50]) [183.108.233.190]:54137: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-01-31 20:59:48 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:59960: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.215.116.20
country_id: 2921044
description:
[2026-01-31 21:00:59 +0800] info [webmaild] 85.215.116.20 - payment@tujusetia.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2026-01-31 21:00:23 dovecot_login authenticator failed for H=(163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:59877: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.203.132.68
country_id: 2658434
domain: ahfengineering.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/index.php||SC:/home2/ahfe3522/public_html/wp-admin/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-01-31 21:00:03 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:40310: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.50.94.29
country_id: 1605651
description:
2026-01-31 21:00:07 dovecot_login authenticator failed for H=([147.50.94.29]) [147.50.94.29]:51924: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/images/home/private-residence.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.137.72.22
country_id: 3017382
description:
2026-01-31 21:02:20 dovecot_plain authenticator failed for H=22.ip-79-137-72.eu (k9lq8xgsm4hiclvvfw) [79.137.72.22]:63907: 535 Incorrect authentication data (set_id=joshuaooi@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.166.166
country_id: 6252001
description:
2026-01-31 21:02:22 dovecot_login authenticator failed for H=(ADMIN) [181.214.166.166]:60855: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.162
country_id: 1269750
description:
2026-01-31 21:03:17 dovecot_login authenticator failed for H=(nsg-corporate-162.230.187.122.airtel.in) [122.187.230.162]:57941: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-01-31 21:03:32 +0800] info [cpaneld] 185.204.54.153 - imax "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user imax (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 21:03:45 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:60358: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 139.59.113.221
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS_NAMES:I6oFfwazsYHqpoTm0Pc!@#$%%^22||MV:I6oFfwazsYHqpoTm0Pc!@#$%%^22||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:04:40 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63311: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: modsec
rule: 77142167
name: IM360 WAF: Block URI containing malicious URLs
abuser: 139.59.113.221
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Block URI containing malicious URLs||RSV:7.71||T:APACHE||MVN:ARGS:pwd||SC:/home/oxboldc/public_html/blog/wp-login.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.120.7.65
country_id: 630336
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/poster/9/343/944563 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.227.193.21
country_id: 1814991
description:
2026-01-31 21:05:42 dovecot_login authenticator failed for H=([124.227.193.21]) [124.227.193.21]:51843: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.4.153.7
country_id: 1814991
description:
2026-01-31 21:06:00 dovecot_login authenticator failed for H=([221.4.153.7]) [221.4.153.7]:42708: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:05:04 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:56927: 535 Incorrect authentication data (set_id=testing@chs.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 21:05:12 H=([167.148.167.71]) [167.148.167.71]:57219 F=<Support@tujusetia.my> rejected RCPT <shirley.wong@tujusetia.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.166.62
country_id: 2017370
description:
2026-01-31 21:06:07 dovecot_login authenticator failed for H=(dynamicip-109-195-166-62.pppoe.ryazan.ertelecom.ru) [109.195.166.62]:60512: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:06:16 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:50462: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 21:06:39 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:52757: 535 Incorrect authentication data (set_id=test@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 21:07:47 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:51007: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.9.46.208
country_id: 2029969
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/mockery/mockery/docs/reference/object_recording.rst HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2026-01-31 21:08:17 dovecot_login authenticator failed for H=([103.56.85.65]) [128.185.227.166]:43274: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.72
country_id: 1814991
description:
2026-01-31 21:08:21 dovecot_login authenticator failed for H=(72.20.167.124.adsl-pool.sx.cn) [124.167.20.72]:56825: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.82
country_id: 1269750
description:
2026-01-31 21:09:00 dovecot_login authenticator failed for H=(nsg-corporate-82.230.187.122.airtel.in) [122.187.230.82]:60952: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.244.113.178
country_id: 2017370
description:
2026-01-31 21:09:37 dovecot_login authenticator failed for H=(91.244.113.178.wirenet.tv) [91.244.113.178]:57337: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
country_id: 1269750
description:
2026-01-31 21:09:58 dovecot_login authenticator failed for H=([103.55.89.5]) [116.75.218.103]:57226: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.23.240.134
country_id: 953987
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=697884 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.240
country_id: 1668284
description:
2026-01-31 21:09:51 dovecot_login authenticator failed for H=111-70-23-240.emome-ip.hinet.net [111.70.23.240]:36111: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.25.9.85
country_id: 1210997
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=975297 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2026-01-31 21:09:45 dovecot_login authenticator failed for H=(syn-024-104-225-201.res.spectrum.com) [24.104.225.201]:40040: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.129.236.174
country_id: 1814991
description:
2026-01-31 21:10:13 dovecot_login authenticator failed for H=([219.129.236.174]) [219.129.236.174]:55283: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:10:16 dovecot_login authenticator failed for H=(2UUmNVCCGx) [45.94.31.131]:62490: 535 Incorrect authentication data (set_id=krish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.175.182
country_id: 357994
description:
2026-01-31 21:10:17 dovecot_login authenticator failed for H=([41.65.118.172]) [154.177.175.182]:56950: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.120.40
country_id: 1814991
description:
2026-01-31 21:10:21 dovecot_login authenticator failed for H=([39.152.120.40]) [39.152.120.40]:37306: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-01-31 21:10:09 dovecot_login authenticator failed for H=(made-again.tmesis.com) [24.187.213.29]:59466: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.203.132.68
country_id: 2658434
domain: agpc.org.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home/agpcorg/public_html/wp-admin/images/commentv.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.15.132
country_id: 1814991
description:
2026-01-31 21:10:27 dovecot_login authenticator failed for H=([222.128.15.132]) [222.128.15.132]:39984: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:11:23 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:60693: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-31 21:11:43 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:41718: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 21:11:16 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:26753: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2026-01-31 21:11:18 dovecot_login authenticator failed for H=(nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:55582: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:11:18 dovecot_login authenticator failed for H=(GLjwriug) [45.94.31.131]:63994: 535 Incorrect authentication data (set_id=krish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.87.152
country_id: 1814991
description:
2026-01-31 21:12:08 dovecot_login authenticator failed for H=([111.61.87.152]) [111.61.87.152]:21878: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:12:18 dovecot_login authenticator failed for H=(QnA5ZRas) [45.94.31.131]:60867: 535 Incorrect authentication data (set_id=krish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:12:04 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:61648: 535 Incorrect authentication data


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.203.132.68
country_id: 2658434
domain: agpc.org.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/agpcorg/public_html/wp-admin/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2026-01-31 21:12:28 dovecot_login authenticator failed for H=(nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:51374: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:13:19 dovecot_login authenticator failed for H=(hldJieTYp) [45.94.31.131]:54007: 535 Incorrect authentication data (set_id=krish)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.244.154.160
country_id: 99237
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=784798 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 21:13:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account krish has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:13:06 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:60468: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.91.153.26
country_id: 3077311
description:
2026-01-31 21:14:11 dovecot_login authenticator failed for H=u153-26.static.grape.cz [93.91.153.26]:49387: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:14:19 dovecot_login authenticator failed for H=(WLcOYsnxJ) [45.94.31.131]:63668: 535 Incorrect authentication data (set_id=krish)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 21:14:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account krish has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.177.49.7
country_id: 2017370
description:
2026-01-31 21:14:34 dovecot_login authenticator failed for H=([178.177.49.7]) [178.177.49.7]:44083: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 21:14:36 H=([167.148.167.71]) [167.148.167.71]:51312 F=<Support@ajplantations.com.my> rejected RCPT <spyong@ajplantations.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.173.156.68
country_id: 1814991
description:
2026-01-31 21:14:53 dovecot_login authenticator failed for H=([61.173.156.68]) [61.173.156.68]:24864: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 21:15:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account krish has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.143.201.18
country_id: 690791
description:
2026-01-31 21:15:48 dovecot_login authenticator failed for H=(host-18-201-143-83.reedlan.com) [83.143.201.18]:59414: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.198.31
country_id: 1814991
description:
2026-01-31 21:15:56 dovecot_login authenticator failed for H=([183.167.198.31]) [183.167.198.31]:57559: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.37.198.190
country_id: 6252001
description:
2026-01-31 21:16:01 dovecot_login authenticator failed for H=(host190.covisint.com) [64.37.198.190]:58009: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:15:18 dovecot_login authenticator failed for H=(c5wIWLVtv) [45.94.31.131]:63473: 535 Incorrect authentication data (set_id=krish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.134
country_id: 2017370
description:
2026-01-31 21:15:39 dovecot_login authenticator failed for H=([178.178.194.134]) [178.178.194.134]:43836: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.160.100
country_id: 6252001
description:
2026-01-31 21:16:06 dovecot_login authenticator failed for H=syn-024-105-160-100.biz.spectrum.com [24.105.160.100]:54566: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.82
country_id: 1269750
description:
2026-01-31 21:16:11 dovecot_login authenticator failed for H=([182.95.87.148]) [182.95.184.82]:50032: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.157.254.194
country_id: 2017370
description:
2026-01-31 21:16:13 dovecot_login authenticator failed for H=(93.157.254.194.dynamic.ufanet.ru) [93.157.254.194]:55338: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 21:16:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account krish has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:16:20 dovecot_login authenticator failed for H=(b57jq8y) [45.94.31.131]:62273: 535 Incorrect authentication data (set_id=krish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-31 21:16:50 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:55578: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.216.58.147
country_id: 1210997
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.aoto.com.my/index.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:17:20 dovecot_login authenticator failed for H=(7SqXEO4) [45.94.31.131]:51602: 535 Incorrect authentication data (set_id=krish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-01-31 21:17:31 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:44930: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.217.68.100
country_id: 1814991
description:
2026-01-31 21:17:33 dovecot_login authenticator failed for H=([171.217.68.100]) [171.217.68.100]:51860: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.36
country_id: 2245662
description:
2026-01-31 21:17:44 dovecot_login authenticator failed for H=([213.154.80.21]) [213.154.80.36]:47703: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-01-31 21:17:45 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:34910: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 21:17:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account krish has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:17:39 dovecot_login authenticator failed for H=(Gn63sAAxQ) [45.94.31.131]:49710: 535 Incorrect authentication data (set_id=krish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:17:53 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:52240: 535 Incorrect authentication data (set_id=testing@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 21:18:47 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:60291: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:18:12 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:57124: 535 Incorrect authentication data (set_id=testing@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:18:18 dovecot_login authenticator failed for H=(wrdMNTP) [45.94.31.131]:64638: 535 Incorrect authentication data (set_id=krish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:19:18 dovecot_login authenticator failed for H=(Yu2lmAt) [45.94.31.131]:60654: 535 Incorrect authentication data (set_id=krish)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.239.207.132
country_id: 690791
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=886497 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.61.176.110
country_id: 3469034
description:
2026-01-31 21:19:59 dovecot_login authenticator failed for H=([187.50.122.20]) [177.61.176.110]:34178: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 21:19:14 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:63016: 535 Incorrect authentication data (set_id=testing@nexuscollection.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.75.254.157
country_id: 3017382
description:
[2026-01-31 21:19:24 +0800] info [cpaneld] 51.75.254.157 - tujuseti "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tujuseti (has_cpuser_file failed)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:19:31 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64684: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.207
country_id: 2186224
description:
2026-01-31 21:19:33 dovecot_login authenticator failed for H=([121.73.168.207]) [121.73.168.207]:60200: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/img/druma_photos/services.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.168
country_id: 1269750
description:
2026-01-31 21:20:33 dovecot_login authenticator failed for H=(nsg-corporate-168.229.187.122.airtel.in) [122.187.229.168]:44679: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2026-01-31 21:20:34 dovecot_login authenticator failed for H=([38.226.118.9]) [38.226.118.0]:36942: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.166.226.235
country_id: 1643084
description:
2026-01-31 21:20:54 dovecot_login authenticator failed for H=([103.166.226.235]) [103.166.226.235]:38612: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:20:19 dovecot_login authenticator failed for H=(EKNmkyN) [45.94.31.131]:49981: 535 Incorrect authentication data (set_id=krish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.208
country_id: 732800
description:
2026-01-31 21:20:54 dovecot_login authenticator failed for H=(151.237.115.208.pronet.bg) [151.237.115.208]:52790: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:21:18 dovecot_login authenticator failed for H=(rafwGJCH) [45.94.31.131]:56882: 535 Incorrect authentication data (set_id=krish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2026-01-31 21:21:48 dovecot_login authenticator failed for H=([83.239.84.130]) [83.239.84.130]:46411: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.89.228.203
country_id: 1861060
domain: mail.hmz.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/hmzcom/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.166
country_id: 1269750
description:
2026-01-31 21:21:25 dovecot_login authenticator failed for H=([125.19.173.189]) [182.95.181.166]:47220: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/img/druma_photos/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
country_id: 2077456
description:
2026-01-31 21:21:16 dovecot_login authenticator failed for H=165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:50772: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 21:21:12 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:60721: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.173.39.103
country_id: 2017370
description:
2026-01-31 21:21:34 dovecot_login authenticator failed for H=broadband-109-173-39-103.ip.moscow.rt.ru [109.173.39.103]:56412: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 21:21:37 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account krish has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.34.152.68
country_id: 1814991
description:
2026-01-31 21:21:49 dovecot_login authenticator failed for H=([203.34.152.68]) [203.34.152.68]:51594: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 21:22:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account krish has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.246.106
country_id: 1269750
description:
2026-01-31 21:22:29 dovecot_login authenticator failed for H=([125.17.216.185]) [128.185.246.106]:52556: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.75
country_id: 1269750
description:
2026-01-31 21:22:59 dovecot_login authenticator failed for H=([203.193.147.75]) [203.193.147.75]:39190: 535 Incorrect authentication data (set_id=info@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:22:17 dovecot_login authenticator failed for H=(NLSPyESp) [45.94.31.131]:54186: 535 Incorrect authentication data (set_id=krish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.235.140.163
country_id: 2017370
description:
2026-01-31 21:22:25 dovecot_login authenticator failed for H=(37-235-140-163.dynamic.customer.lanta.me) [37.235.140.163]:43680: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.60.46
country_id: 1168579
description:
2026-01-31 21:22:44 dovecot_login authenticator failed for H=([203.124.60.46]) [203.124.60.46]:55013: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-31 21:22:05 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:31711: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.140.70.147
country_id: 2802361
description:
2026-01-31 21:23:32 dovecot_login authenticator failed for H=147.70.140.34.bc.googleusercontent.com (10.132.0.2) [34.140.70.147]:58826: 535 Incorrect authentication data (set_id=usman@symphony-led.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-01-31 21:23:24 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:55212: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:23:34 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:62888: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-31 21:23:26 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:46905: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2026-01-31 21:23:47 dovecot_login authenticator failed for H=([169.211.232.182]) [169.211.232.182]:45780: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:23:56 dovecot_login authenticator failed for H=(mEi6pcL3d9) [45.94.31.131]:60866: 535 Incorrect authentication data (set_id=krish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:23:16 dovecot_login authenticator failed for H=(PVDgfIm68h) [45.94.31.131]:58837: 535 Incorrect authentication data (set_id=krish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
country_id: 2017370
description:
2026-01-31 21:23:46 dovecot_login authenticator failed for H=([95.79.108.51]) [95.79.108.51]:49340: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 21:23:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account krish has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 21:24:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account krish has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:24:16 dovecot_login authenticator failed for H=(VSvyODHzNp) [45.94.31.131]:54673: 535 Incorrect authentication data (set_id=krish)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.234.53.134
country_id: 6252001
description:
[2026-01-31 21:24:03 +0800] info [cpaneld] 104.234.53.134 - oxboldc "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:24:10 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:54016: 535 Incorrect authentication data


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ea75f0dec9c310d87f4d45a02de89dedc717d9d5||Title:0xfe9c059b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:25:14 dovecot_login authenticator failed for H=(1TjdLP) [45.94.31.131]:58323: 535 Incorrect authentication data (set_id=krish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.100.159.2
country_id: 1835841
description:
2026-01-31 21:25:44 dovecot_login authenticator failed for H=([222.100.159.2]) [222.100.159.2]:52573: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.204
country_id: 337996
description:
2026-01-31 21:25:55 dovecot_login authenticator failed for H=([196.191.212.226]) [213.55.85.204]:7294: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 21:25:12 H=([167.148.167.71]) [167.148.167.71]:59456 F=<Support@symphony-led.com> rejected RCPT <symphony@symphony-led.com>: smtp auth required


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 21:25:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account krish has been locked for the attacker IP 45.94.31.131


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f15607fe633bebb6f3b95efae003f059c2d207a0||Title:0x98195891||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-01-31 21:25:47 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:56496: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:26:13 dovecot_login authenticator failed for H=(eRIdYX2TX) [45.94.31.131]:61909: 535 Incorrect authentication data (set_id=krish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-01-31 21:26:28 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:56596: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.48.25.24
country_id: 6252001
description:
[2026-01-31 21:26:31 +0800] info [cpaneld] 86.48.25.24 - webhosti "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user webhosti (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2026-01-31 21:26:49 dovecot_login authenticator failed for H=([183.182.99.92]) [183.182.99.92]:54799: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 21:26:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account krish has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.242
country_id: 1733045
description:
2026-01-31 21:26:20 dovecot_login authenticator failed for H=([49.124.152.242]) [49.124.152.242]:52902: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2026-01-31 21:26:30 dovecot_login authenticator failed for H=([83.136.176.12]) [83.136.176.12]:48766: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-01-31 21:26:17 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:51198: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2026-01-31 21:26:58 dovecot_login authenticator failed for H=([187.237.47.214]) [187.237.47.214]:59335: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:55376236cba9c6a37733daa989a0872f54c07a88||Title:0x8155230d||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.235.252
country_id: 6252001
description:
2026-01-31 21:27:54 dovecot_login authenticator failed for H=(ADMIN) [102.129.235.252]:38692: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 60.13.6.80
country_id: 1814991
description:
2026-01-31 21:27:04 141124 [Warning] Aborted connection 141124 to db: 'unconnected' user: 'unauthenticated' host: '60.13.6.80' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:27:12 dovecot_login authenticator failed for H=(FKO95j) [45.94.31.131]:60526: 535 Incorrect authentication data (set_id=krish)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:28:32 dovecot_login authenticator failed for H=(h7KwNAl) [45.94.31.131]:63921: 535 Incorrect authentication data (set_id=krish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:28:12 dovecot_login authenticator failed for H=(GIhM4sE) [45.94.31.131]:56879: 535 Incorrect authentication data (set_id=krish)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:43ef204665b3b50077a8bc4e71d17e37f5505b1c||Title:0x4437b907||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 206.189.90.199
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Possible SQLi in arguments||MVN:ARGS:pwd||MV:cuciinocit11xkosanbangle22!@#$%^||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a43e57d32a0f78068c8441faa78e4a936f74e48c||Title:0x09d4de4c||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 112.208.164.77
country_id: 1694008
domain: hmz.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:43372.hmz.com.my||ServerName:hmz.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7a83498e0167fbfd8106afdb89ff432f29d7cdb6||Title:0xdc08efa0||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 221.199.73.129
country_id: 1814991
description:
2026-01-31 21:29:57 144654 [Warning] Aborted connection 144654 to db: 'unconnected' user: 'unauthenticated' host: '221.199.73.129' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 21:29:12 dovecot_login authenticator failed for H=(MteutdN) [45.94.31.131]:65007: 535 Incorrect authentication data (set_id=krish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.153
country_id: 2658434
description:
2026-01-31 21:29:18 dovecot_plain authenticator failed for H=(5D5E03B.online-server.cloud) [158.173.152.153]:17382: 535 Incorrect authentication data (set_id=project@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:29:55 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:54657: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:30:07 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64294: 535 Incorrect authentication data (set_id=testing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-01-31 21:31:41 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:34440: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f98329205c3b174e355461f53e968554aa88a652||Title:0x22eef13d||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:31:09 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:53230: 535 Incorrect authentication data (set_id=testing@wcc.wohcheong.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:31:51 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:57193: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.189
country_id: 1814991
description:
2026-01-31 21:32:06 dovecot_login authenticator failed for H=([111.61.177.189]) [111.61.177.189]:32780: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:088cff240406d8a05cd382948b505142fb17bab5||Title:0x023da551||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2026-01-31 21:33:06 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:59082: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2026-01-31 21:33:33 dovecot_login authenticator failed for H=([27.123.119.219]) [182.95.226.118]:33000: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:34:42 dovecot_login authenticator failed for H=(CbuObEtm9) [185.169.4.188]:60283: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.241.232.14
country_id: 2921044
description:
2026-01-31 21:34:48 dovecot_login authenticator failed for H=p5df1e80e.dip0.t-ipconnect.de [93.241.232.14]:45503: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c3c5757558b3046982f18fa1c3ffe27cc988775a||Title:0xba524d63||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.236.76.10
country_id: 1814991
description:
2026-01-31 21:34:04 dovecot_login authenticator failed for H=([120.236.76.10]) [120.236.76.10]:23971: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.37.180.247
country_id: 357994
description:
2026-01-31 21:34:29 dovecot_plain authenticator failed for H=(CHXEI8NX18) [41.37.180.247]:59070: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.243.58
country_id: 1814991
description:
2026-01-31 21:34:03 dovecot_login authenticator failed for H=([218.21.243.58]) [218.21.243.58]:37864: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8f1196301ec16ef90db7930c9c55decd7f748ad1||Title:0x3d33b6a4||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 21:35:48 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:63890: 535 Incorrect authentication data (set_id=test@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.206.54
country_id: 1269750
description:
2026-01-31 21:35:56 dovecot_login authenticator failed for H=([182.95.3.57]) [125.19.206.54]:43184: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.27.42.6
country_id: 6252001
description:
[2026-01-31 21:36:02 +0800] info [cpaneld] 34.27.42.6 - nexuscol "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nexuscol (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.161.52.149
country_id: 1814991
description:
2026-01-31 21:35:04 dovecot_login authenticator failed for H=([220.161.52.149]) [220.161.52.149]:51079: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.22
country_id: 1149361
description:
2026-01-31 21:35:15 dovecot_login authenticator failed for H=([149.54.62.22]) [149.54.62.22]:45066: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:35:10 dovecot_login authenticator failed for H=(FqmvtLI7) [185.169.4.188]:50399: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 21:36:06 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:56745: 535 Incorrect authentication data (set_id=test@nexuscollection.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:140248e7e870a7539165c1c74c1ba2288951025e||Title:0xf00b9253||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 21:36:21 H=([167.148.167.71]) [167.148.167.71]:52628 F=<Support@tst-ma.com> rejected RCPT <tst@tst-ma.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:36:51 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:61859: 535 Incorrect authentication data (set_id=test@box.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.27.42.6
country_id: 6252001
description:
[2026-01-31 21:36:04 +0800] info [cpaneld] 34.27.42.6 - nexuscollection "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nexuscollection (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2026-01-31 21:36:15 dovecot_login authenticator failed for H=(nsg-static-145.58.71.182.airtel.in) [27.123.102.50]:60658: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:36:18 dovecot_login authenticator failed for H=(EeVOC1n) [185.169.4.188]:51965: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:37:15 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:53975: 535 Incorrect authentication data (set_id=test@box.wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:37:03 dovecot_login authenticator failed for H=(xQ3vWt7Vz) [185.169.4.188]:50131: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:38:02 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64355: 535 Incorrect authentication data (set_id=test@mams1.manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:38:46 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:53441: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 206.189.90.199
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Possible SQLi in arguments||MVN:ARGS:pwd||MV:mimmckmuokma1fwj)*nzrcf#||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 21:38:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky@essemgroup.net has been locked for the attacker IP 185.169.4.188


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:79bc91366f647704061007ad3ec9ae348eaa25ea||Title:0xa17f70f9||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:38:13 dovecot_login authenticator failed for H=(rTscH5cTF) [185.169.4.188]:57287: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:39:21 dovecot_login authenticator failed for H=(EivjVgMtmu) [185.169.4.188]:65122: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:77f957fa80ea6f96dd42378b40fd51043b19b5c0||Title:0x958f4c9c||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.49.14
country_id: 1814991
description:
2026-01-31 21:39:42 dovecot_login authenticator failed for H=([121.18.49.14]) [121.18.49.14]:14170: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 21:39:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky@essemgroup.net has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.51.5
country_id: 1668284
description:
2026-01-31 21:39:59 dovecot_login authenticator failed for H=111-70-51-5.emome-ip.hinet.net [111.70.51.5]:52512: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.102
country_id: 1269750
description:
2026-01-31 21:40:07 dovecot_login authenticator failed for H=([27.123.119.99]) [182.95.224.102]:48008: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.170
country_id: 1814991
description:
2026-01-31 21:40:13 dovecot_login authenticator failed for H=([116.114.84.170]) [116.114.84.170]:55430: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 21:40:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky@essemgroup.net has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:40:07 dovecot_login authenticator failed for H=(07NCGG5) [185.169.4.188]:50887: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.248.250.143
country_id: 298795
description:
2026-01-31 21:41:39 dovecot_login authenticator failed for H=(88.248.250.143.static.ttnet.com.tr) [88.248.250.143]:49808: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-01-31 21:41:51 dovecot_login authenticator failed for H=([125.19.175.93]) [182.95.176.122]:38256: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:41:15 dovecot_login authenticator failed for H=(62JO1rUss) [185.169.4.188]:62714: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0bd1f84d5d296a540408c6981eb0f8b4685e0520||Title:0x2613a303||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 21:41:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky@essemgroup.net has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 21:42:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky@essemgroup.net has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2026-01-31 21:42:45 dovecot_login authenticator failed for H=(visaotur.sdr.gvt.net.br) [186.215.245.175]:37420: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-31 21:42:59 H=([64.89.160.15]) [64.89.160.15]:63981 F=<essenas@outlook.com> rejected RCPT <mustapa@astlog.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.108.14.226
country_id: 1814991
description:
2026-01-31 21:42:58 dovecot_login authenticator failed for H=([202.108.14.226]) [202.108.14.226]:36346: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.161.14.45
country_id: 1814991
description:
2026-01-31 21:42:45 dovecot_login authenticator failed for H=([180.129.252.55]) [60.161.14.45]:40806: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.89.15.173
country_id: 1522867
description:
2026-01-31 21:43:02 dovecot_login authenticator failed for H=178.89.15.173.dynamic.telecom.kz [178.89.15.173]:51834: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.162.18.150
country_id: 1835841
description:
2026-01-31 21:42:32 dovecot_login authenticator failed for H=([112.162.18.150]) [112.162.18.150]:43908: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f48268dd42560a3464331a3003d242393e46a356||Title:0x6b352120||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:42:24 dovecot_login authenticator failed for H=(MxrPc4qwiL) [185.169.4.188]:55083: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.168.113.8
country_id: 3469034
description:
[2026-01-31 21:43:15 +0800] info [cpaneld] 45.168.113.8 - dscexpat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.104.224.37
country_id: 2589581
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/Tests/EventListener/ProfilerListenerTest.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: webhosting2u.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/class.php||SC:/home/webhost/public_html/images||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.211.164.12
country_id: 2077456
domain: webhosting2u.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/webhost/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:43:10 dovecot_login authenticator failed for H=(BLHRCId) [185.169.4.188]:58298: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:43:21 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:61674: 535 Incorrect authentication data (set_id=testing@box.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:43:56 dovecot_login authenticator failed for H=(bE8mfa) [185.169.4.188]:64401: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: webhosting2u.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/media/wp-login.php||SC:/home/webhost/public_html/wp-includes||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8853308d8f16534934233fa393bc89cb22878130||Title:0x7b77dc5f||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:44:14 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:50439: 535 Incorrect authentication data (set_id=testing@sv3.nocser.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:44:19 dovecot_login authenticator failed for H=(XDG299cFMl) [185.169.4.188]:59523: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:45:05 dovecot_login authenticator failed for H=(iW45iXdo) [185.169.4.188]:63498: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9d0bfdb7690c3c81716161c451ab1152066d087e||Title:0x17341d68||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 21:45:36 dovecot_login authenticator failed for H=(0tbtMqqG2) [178.16.54.138]:60826: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 206.189.90.199
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Possible SQLi in arguments||MVN:ARGS:pwd||MV:r^e'4hfx33 ~d.<2}#fesg9<x!?^zf||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.187.2
country_id: 1269750
description:
2026-01-31 21:46:55 dovecot_login authenticator failed for H=([128.185.187.2]) [128.185.187.2]:45998: 535 Incorrect authentication data (set_id=amir)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:71dfdff90919d2905b0bbe2e0ff862e112c6f085||Title:0xff96bbf8||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.34
country_id: 1269750
description:
2026-01-31 21:47:01 dovecot_login authenticator failed for H=(nsg-corporate-78.223.187.122.airtel.in) [182.66.214.34]:55422: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:46:15 dovecot_login authenticator failed for H=(z72905) [185.169.4.188]:61822: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 21:46:22 dovecot_login authenticator failed for H=(2fh3gC9vTo) [178.16.54.138]:58298: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.248.122
country_id: 1269750
description:
2026-01-31 21:46:35 dovecot_login authenticator failed for H=([122.185.248.122]) [122.185.248.122]:44848: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 21:46:59 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky@essemgroup.net has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2026-01-31 21:47:43 dovecot_login authenticator failed for H=(nsg-corporate-36.229.187.122.airtel.in) [122.187.229.36]:36149: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 21:47:56 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:49378: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 21:47:08 dovecot_login authenticator failed for H=(JQ7kVWbx) [178.16.54.138]:58526: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.24.61.209
country_id: 99237
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=233781 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 21:47:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky@essemgroup.net has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:47:24 dovecot_login authenticator failed for H=(pxjYD9FzsR) [185.169.4.188]:61733: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:62bebd40bc53cb6b9b773cbace83bba787cfb363||Title:0x320d8ff7||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-01-31 21:48:34 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:46240: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-01-31 21:48:44 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:38180: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 21:48:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky@essemgroup.net has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:48:09 dovecot_login authenticator failed for H=(fclwjI) [185.169.4.188]:65036: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 21:48:17 dovecot_login authenticator failed for H=(eGEsxD) [178.16.54.138]:53871: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 21:48:01 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:49557: 535 Incorrect authentication data (set_id=testing@aircarbonic.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-01-31 21:48:04 +0800] info [cpaneld] 185.204.54.153 - mssa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mssa (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 21:49:35 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:56721: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:49:39 dovecot_login authenticator failed for H=(sFrPuj) [185.169.4.188]:57698: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 21:49:04 dovecot_login authenticator failed for H=(VvSJ35ibcg) [178.16.54.138]:51972: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 21:49:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky@essemgroup.net has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:49:16 dovecot_login authenticator failed for H=(Vvvn2DB) [185.169.4.188]:63877: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:073ad18fdc4f8a4cc5cf67b813c204cee1e0eff8||Title:0xf533fdc2||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 206.189.90.199
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Possible SQLi in arguments||MVN:ARGS:pwd||MV:s]txp7-,m2vd$_c$^r`vg4r.'#@el`||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 21:49:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 21:50:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 21:50:13 dovecot_login authenticator failed for H=(f8tjdui) [178.16.54.138]:59714: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 21:50:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky@essemgroup.net has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.126.53.11
country_id: 1835841
description:
2026-01-31 21:50:08 dovecot_login authenticator failed for H=([168.126.53.11]) [168.126.53.11]:60168: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:50:13 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:55298: 535 Incorrect authentication data (set_id=test@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:50:01 dovecot_login authenticator failed for H=(HjerlS1U) [185.169.4.188]:52214: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 21:51:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 21:51:24 dovecot_login authenticator failed for H=(BaYStdoZ) [178.16.54.138]:57919: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:51:15 dovecot_login authenticator failed for H=(DYoBiHpIK9) [185.169.4.188]:53141: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:51:16 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:61721: 535 Incorrect authentication data (set_id=test@mams1.manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 21:51:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky@essemgroup.net has been locked for the attacker IP 185.169.4.188


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:721ea6f2841212790140a542263c5472758e198b||Title:0x1b715762||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 21:52:10 dovecot_login authenticator failed for H=(9hXj5C) [178.16.54.138]:55214: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 21:52:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:52:20 dovecot_login authenticator failed for H=(HLGpQK) [185.169.4.188]:52227: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:eminent.st.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ec00af0f6e763e12bda5899658f111ed334bf105||Title:0x73f6cfcf||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:52:05 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:50159: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:53:06 dovecot_login authenticator failed for H=(qs1Ef8PT) [185.169.4.188]:57149: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 21:53:19 dovecot_login authenticator failed for H=(ErxEBvv) [178.16.54.138]:52203: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.237.58
country_id: 1269750
description:
2026-01-31 21:53:47 dovecot_login authenticator failed for H=([182.95.26.95]) [125.23.237.58]:55688: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.203
country_id: 1835841
description:
2026-01-31 21:53:47 dovecot_login authenticator failed for H=([218.156.93.203]) [218.156.93.203]:59418: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.0.111.246
country_id: 2233387
description:
2026-01-31 21:53:36 dovecot_login authenticator failed for H=(host-129.0.111.246.mtn.cm) [129.0.111.246]:64862: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2026-01-31 21:53:07 dovecot_login authenticator failed for H=([131.161.184.46]) [131.161.184.46]:49042: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 21:53:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:eminent.st.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:698c0c810938e2020dc5003dc0b6b644588b2b71||Title:0x04db4d94||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:54:17 dovecot_login authenticator failed for H=(HD4JBP) [185.169.4.188]:60466: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.69.160
country_id: 1814991
description:
2026-01-31 21:54:57 dovecot_login authenticator failed for H=([111.26.69.159]) [111.26.69.160]:43928: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:54:41 dovecot_login authenticator failed for H=(zXXafHnlJM) [185.169.4.188]:55934: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 21:54:05 dovecot_login authenticator failed for H=(aS0gBx) [178.16.54.138]:50690: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 158.158.35.58
country_id: 2510769
domain: aoto.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/aotocom/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 21:55:14 dovecot_login authenticator failed for H=(jYpuSp) [178.16.54.138]:49992: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.2.51.88
country_id: 1562822
description:
2026-01-31 21:55:45 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [117.2.51.88]:54820: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:55:04 dovecot_login authenticator failed for H=(LW8ooKijy) [185.169.4.188]:52037: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:eminent.st.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:df4d1888771c2a769010dbecdff3510c4383210f||Title:0x43d51a18||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 21:55:48 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky@essemgroup.net has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2026-01-31 21:55:22 dovecot_login authenticator failed for H=([220.93.167.144]) [220.93.167.144]:49496: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.144.14.204
country_id: 1210997
description:
2026-01-31 21:55:04 dovecot_login authenticator failed for H=(14.204.bol-online.com) [122.144.14.204]:63705: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 21:56:23 dovecot_login authenticator failed for H=(Mk4NNhsWcg) [178.16.54.138]:52685: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:56:12 dovecot_login authenticator failed for H=(iV1SKYk) [185.169.4.188]:54433: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 21:56:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky@essemgroup.net has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.206.136
country_id: 1835841
description:
2026-01-31 21:56:10 dovecot_login authenticator failed for H=([14.37.206.136]) [14.37.206.136]:33186: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2026-01-31 21:56:13 dovecot_login authenticator failed for H=([123.129.245.249]) [123.129.245.249]:36701: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 149.202.52.184
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/img/img/demos/img/demos/img/photos/product.php||SC:/home2/pspolycom/public_html/img/img||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:eminent.st.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:12ce6228deb00834cae4204a3a524517a79bff42||Title:0x7ca888c7||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:57:33 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:59085: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 21:57:55 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 21:57:11 dovecot_login authenticator failed for H=(L4paIKE0JL) [178.16.54.138]:51408: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 21:57:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim@cofreth.com.my has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:57:23 dovecot_login authenticator failed for H=(ugsaduI4) [185.169.4.188]:56095: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:57:23 dovecot_login authenticator failed for H=(jfNFnrLWP) [185.169.4.188]:56093: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:58:04 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:59993: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:58:08 dovecot_login authenticator failed for H=(zdGAbF) [185.169.4.188]:62136: 535 Incorrect authentication data (set_id=yennymky)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:eminent.st.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:468c2fcc4ec97d041173182833ca58d5e44f585d||Title:0x83cf8f97||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-01-31 21:58:08 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:33002: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 21:58:20 dovecot_login authenticator failed for H=(mybgAWw) [178.16.54.138]:50404: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 21:58:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim@cofreth.com.my has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 21:58:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.34.120.78
country_id: 2750405
description:
2026-01-31 21:59:50 dovecot_login authenticator failed for H=78.120.34.34.bc.googleusercontent.com (10.164.0.2) [34.34.120.78]:62765: 535 Incorrect authentication data (set_id=chew@nexuscollection.com )


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 206.189.90.199
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Possible SQLi in arguments||MVN:ARGS:pwd||MV:uxct'p/{{3>k;3u\"6qsp3b #x$[7=v||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 21:59:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim@cofreth.com.my has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 21:59:32 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:60725: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:eminent.st.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2038fcb6dfc42990987b46f710a60a5ad27a10ad||Title:0x864abcf9||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.29.231.106
country_id: 1814991
description:
2026-01-31 21:59:39 dovecot_login authenticator failed for H=(hn.kd.ny.adsl) [218.29.231.106]:55621: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.145
country_id: 1819730
description:
2026-01-31 21:59:51 dovecot_login authenticator failed for H=145.47.246.220.static.netvigator.com [220.246.47.145]:56035: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 21:59:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 21:59:12 dovecot_login authenticator failed for H=(gtXlqa7KDI) [178.16.54.138]:56051: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 21:59:18 dovecot_login authenticator failed for H=(YvOuyZ5) [185.169.4.188]:64402: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.83.30.199
country_id: 6252001
description:
2026-01-31 22:00:00 dovecot_login authenticator failed for H=ool-43531ec7.dyn.optonline.net [67.83.30.199]:41169: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.34.120.78
country_id: 2750405
description:
2026-01-31 22:00:10 dovecot_login authenticator failed for H=78.120.34.34.bc.googleusercontent.com (10.164.0.2) [34.34.120.78]:64289: 535 Incorrect authentication data (set_id=chew@nexuscollection.com )


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:00:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:00:13 dovecot_login authenticator failed for H=(icnf2E) [178.16.54.138]:56512: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 185.228.3.54
country_id: 2264397
domain: dsc-expat.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/adriv4.php||SC:/home2/dscexpat/public_html/assets||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-31 22:00:39 H=([64.89.160.15]) [64.89.160.15]:63548 F=<essenas@outlook.com> rejected RCPT <sales@hmz.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.125.67.109
country_id: 1835841
description:
2026-01-31 22:00:21 dovecot_login authenticator failed for H=([39.125.67.109]) [39.125.67.109]:49077: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:eminent.st.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:afb10876c739dcb38af1713ff24f918641b8e0af||Title:0x8bc50aa6||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:00:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim@cofreth.com.my has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:00:05 dovecot_login authenticator failed for H=(EVjJd2) [185.169.4.188]:56074: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.193.149
country_id: 1643084
description:
2026-01-31 22:01:44 dovecot_login authenticator failed for H=([103.186.193.149]) [103.186.193.149]:36700: 535 Incorrect authentication data (set_id=zainuddin)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:eminent.st.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d359f120e04625cf007c095f2dc2add81f4876e4||Title:0xb9622bf4||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:02:00 dovecot_login authenticator failed for H=(KoyZwv3OUm) [185.169.4.188]:62234: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:01:03 dovecot_login authenticator failed for H=(v09ESfB) [178.16.54.138]:49784: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:01:14 dovecot_login authenticator failed for H=(iMC4RQjtc) [185.169.4.188]:56378: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 22:01:17 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:54011: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:01:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 22:01:19 H=([167.148.167.71]) [167.148.167.71]:62543 F=<Support@euratech.com.my> rejected RCPT <zhenwei@euratech.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.120.182
country_id: 3144096
description:
2026-01-31 22:01:34 dovecot_login authenticator failed for H=(cm-178.232.120.182.get.no) [178.232.120.182]:58827: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:01:32 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.228
country_id: 99237
description:
2026-01-31 22:02:30 dovecot_login authenticator failed for H=([65.20.205.228]) [65.20.205.228]:35988: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:02:25 dovecot_login authenticator failed for H=(0VRw3z) [178.16.54.138]:60937: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:02:22 dovecot_login authenticator failed for H=(QH9H9R1) [185.169.4.188]:56336: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-31 22:02:43 dovecot_login authenticator failed for H=(www.safecleen.com) [58.49.113.138]:13130: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.185.37.239
country_id: 1269750
description:
2026-01-31 22:02:41 dovecot_login authenticator failed for H=(abts-tn-dynamic-239.37.185.136.airtelbroadband.in) [136.185.37.239]:58932: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:02:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2026-01-31 22:02:53 dovecot_login authenticator failed for H=([183.182.99.92]) [183.182.99.92]:33120: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 22:02:05 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:62292: 535 Incorrect authentication data (set_id=test@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.39.109.254
country_id: 3576396
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/products/oculusflatlensmalaysia.htm HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:02:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:eminent.st.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:472c3b1110341b0cb9f78ff30434676bc766bd34||Title:0x99449c86||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-01-31 22:03:31 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:40106: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.30.135
country_id: 1527747
description:
2026-01-31 22:03:58 dovecot_login authenticator failed for H=(217-29-30-135.saimanet.kg) [217.29.30.135]:60461: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.199.172.66
country_id: 1814991
description:
2026-01-31 22:03:16 dovecot_login authenticator failed for H=([221.199.172.66]) [221.199.172.66]:39582: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:03:08 dovecot_login authenticator failed for H=(1rIJd6M4) [185.169.4.188]:62112: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:03:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:03:11 dovecot_login authenticator failed for H=(15NSG6AnK) [178.16.54.138]:53018: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 22:03:48 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:51682: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:04:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky has been locked for the attacker IP 185.169.4.188


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:eminent.st.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:379740b8a9e4f5fe176cc75251233b6e0356864d||Title:0x0b04f37d||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2026-01-31 22:04:44 dovecot_login authenticator failed for H=([187.237.47.214]) [187.237.47.214]:49969: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.126
country_id: 1819730
description:
2026-01-31 22:04:04 dovecot_login authenticator failed for H=(223-197-145-126.static.imsbiz.com) [223.197.145.126]:60446: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:04:17 dovecot_login authenticator failed for H=(3oVMUXF4k) [185.169.4.188]:64039: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:04:19 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:58929: 535 Incorrect authentication data (set_id=test@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2026-01-31 22:04:19 dovecot_login authenticator failed for H=([122.187.230.227]) [122.187.230.227]:44221: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.26.113
country_id: 1522867
description:
2026-01-31 22:04:09 dovecot_login authenticator failed for H=2.135.26.113.dynamic.telecom.kz [2.135.26.113]:44643: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:04:35 dovecot_login authenticator failed for H=(6XmH7i6DwZ) [178.16.54.138]:61830: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:04:46 dovecot_login authenticator failed for H=(BF9Fq7p) [185.169.4.188]:61119: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:05:13 dovecot_login authenticator failed for H=(EBtCGtk) [178.16.54.138]:65015: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:eminent.st.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:411d852f79cf4f65916181257f338e3bc2083885||Title:0x69c43e33||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:05:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:05:08 dovecot_login authenticator failed for H=(THiWv4F4VF) [185.169.4.188]:55271: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:05:10 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:56194: 535 Incorrect authentication data (set_id=test@sv3.nocser.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:06:03 dovecot_login authenticator failed for H=(4qxu4EWYw8) [178.16.54.138]:54509: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:06:09 dovecot_login authenticator failed for H=(T387T2akc) [185.169.4.188]:52381: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2026-01-31 22:06:35 dovecot_login authenticator failed for H=([128.185.223.185]) [27.123.114.190]:41148: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:06:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim@cofreth.com.my has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 22:06:36 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:57464: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2026-01-31 22:06:40 dovecot_login authenticator failed for H=(46.30.161.197.access.ipnet.ua) [46.30.161.197]:60514: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.34.231
country_id: 2029969
description:
2026-01-31 22:06:33 dovecot_plain authenticator failed for H=(LF21D45A3WC8) [103.168.34.231]:44297: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:07:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim@cofreth.com.my has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.98
country_id: 1814991
description:
2026-01-31 22:07:04 dovecot_login authenticator failed for H=([1.30.20.98]) [1.30.20.98]:37592: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:07:02 dovecot_login authenticator failed for H=(Bf71lMDR) [185.169.4.188]:63574: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:07:14 dovecot_login authenticator failed for H=(gwMksn2M) [178.16.54.138]:64094: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.160.134.4
country_id: 2921044
description:
2026-01-31 22:07:17 dovecot_plain authenticator failed for H=a-4.stretch.host (m6crf88td4sbyvze1hzfm67nlwc1ui74) [217.160.134.4]:34250: 535 Incorrect authentication data (set_id=payment@tujusetia.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:07:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2026-01-31 22:07:56 dovecot_login authenticator failed for H=([173.25.186.130]) [173.25.186.130]:57877: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.47.143.210
country_id: 1522867
description:
2026-01-31 22:07:02 dovecot_login authenticator failed for H=([92.47.143.173]) [92.47.143.210]:44222: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-31 22:07:11 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:58116: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 191.189.18.163
country_id: 3469034
domain: imax.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:66864.imax.com.my||ServerName:imax.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c356a95706bab1152c407f44dfae18a3cdd3a017||Title:0x5a1822da||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:eminent.st.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b29a9db5f688b1baa004e3048156c4605ca4dd5b||Title:0xc1776867||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:07:26 dovecot_login authenticator failed for H=(f7CtVvms) [185.169.4.188]:58729: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:08:11 dovecot_login authenticator failed for H=(B1hkGE) [178.16.54.138]:63283: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:eminent.st.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f04c9bc39bbf8424613d78d543b29460670c5d2e||Title:0xbec1f419||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.186.32.24
country_id: 289688
domain: www.plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.plomalite.com/products-services/outdoor-air-conditioning-system-rental.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:08:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:08:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim@cofreth.com.my has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:08:08 dovecot_login authenticator failed for H=(8V34tK9KvE) [185.169.4.188]:63736: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.233.181
country_id: 2017370
description:
2026-01-31 22:08:26 dovecot_login authenticator failed for H=(ipoe-static.mosoblast.rt.ru) [89.109.233.181]:47245: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 74.244.12.212
country_id: 2440476
description:
2026-01-31 22:09:53 186345 [Warning] Aborted connection 186345 to db: 'unconnected' user: 'unauthenticated' host: '74.244.12.212' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:09:01 dovecot_login authenticator failed for H=(oM2M58) [178.16.54.138]:54883: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:09:43 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:09:19 dovecot_login authenticator failed for H=(RG4NbO5) [185.169.4.188]:49631: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-01-31 22:09:56 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:49706: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:09:30 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 74.244.12.212
country_id: 2440476
description:
2026-01-31 22:09:50 186339 [Warning] Aborted connection 186339 to db: 'unconnected' user: 'unauthenticated' host: '74.244.12.212' (This connection closed normally without authentication)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:eminent.st.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6667633764a9cfa5d18971f9621bad35ef626f36||Title:0xff728465||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:10:04 dovecot_login authenticator failed for H=(FceDJ5) [185.169.4.188]:54893: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:10:08 dovecot_login authenticator failed for H=(hofDvHC) [185.169.4.188]:56735: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.118
country_id: 1814991
description:
2026-01-31 22:10:24 dovecot_login authenticator failed for H=([111.61.175.118]) [111.61.175.118]:22732: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-31 22:10:43 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:11555: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:10:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.140.70.147
country_id: 2802361
description:
2026-01-31 22:10:58 dovecot_login authenticator failed for H=147.70.140.34.bc.googleusercontent.com (10.132.0.2) [34.140.70.147]:51178: 535 Incorrect authentication data (set_id=joshuaooi@ms-chemicals.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.247.11
country_id: 1733045
description:
[2026-01-31 22:10:57 +0800] info [webmaild] 27.125.247.11 - kwangpeng@ktlog.com.my "GET /cpsess2049891849/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:10:34 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63316: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 83.187.172.17
country_id: 2661886
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/video.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:10:22 dovecot_login authenticator failed for H=(nZ5bLNx) [178.16.54.138]:53082: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:10:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.140.70.147
country_id: 2802361
description:
2026-01-31 22:11:06 dovecot_login authenticator failed for H=147.70.140.34.bc.googleusercontent.com (10.132.0.2) [34.140.70.147]:51620: 535 Incorrect authentication data (set_id=joshuaooi@ms-chemicals.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:eminent.st.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c106e43683e47f7e2080307c83656825e00887c2||Title:0xf5b4038d||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.123.219.137
country_id: 1835841
description:
2026-01-31 22:11:03 dovecot_login authenticator failed for H=([203.123.219.137]) [203.123.219.137]:53628: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:11:13 dovecot_login authenticator failed for H=(RvRBhi8) [185.169.4.188]:52681: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:11:04 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64981: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:11:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:11:11 dovecot_login authenticator failed for H=(hK3lfmUULm) [178.16.54.138]:62971: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:11:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:12:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:12:05 dovecot_login authenticator failed for H=(UCjspfnu) [185.169.4.188]:57927: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:12:14 dovecot_login authenticator failed for H=(Qo44L7CDY) [178.16.54.138]:54807: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:12:02 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:54743: 535 Incorrect authentication data (set_id=testing@sv3.nocser.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.247.11
country_id: 1733045
description:
[2026-01-31 22:12:26 +0800] info [webmaild] 27.125.247.11 - kwangpeng@ktlog.com.my "GET /cpsess2049891849/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:12:39 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:58684: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:eminent.st.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:45dfb25d4b416697ef7028266ee2a96801ee5270||Title:0x198a61b7||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.144.49.74
country_id: 1210997
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/img/photos/9847114844.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:13:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim@cofreth.com.my has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:13:09 dovecot_login authenticator failed for H=(7gqXIIRY8) [185.169.4.188]:55022: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:13:21 dovecot_login authenticator failed for H=(rmQQ2JW) [178.16.54.138]:57870: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:eminent.st.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:251788dcfe17bc8de40910e0cfcad71304fa21c0||Title:0x5b7a36e4||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.39.140.2
country_id: 1835841
description:
2026-01-31 22:13:07 dovecot_login authenticator failed for H=([36.39.140.2]) [36.39.140.2]:37805: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.129.90.215
country_id: 2921044
description:
2026-01-31 22:13:14 dovecot_login authenticator failed for H=ns3241969.ip-57-129-90.eu [57.129.90.215]:36394: 535 Incorrect authentication data (set_id=aziz)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.125.223.63
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=762538 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.151.106.247
country_id: 1814991
description:
2026-01-31 22:14:37 dovecot_login authenticator failed for H=(v574776.hosted-by-vdsina.com) [117.151.106.247]:14806: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 74.244.12.212
country_id: 2440476
description:
2026-01-31 22:15:00 186523 [Warning] Aborted connection 186523 to db: 'unconnected' user: 'unauthenticated' host: '74.244.12.212' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.106.28.168
country_id: 99237
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=44501516696477 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:14:14 dovecot_login authenticator failed for H=(oGBobMIq) [178.16.54.138]:57198: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.23.168
country_id: 1814991
description:
2026-01-31 22:14:21 dovecot_login authenticator failed for H=([120.238.23.168]) [120.238.23.168]:52512: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-01-31 22:14:41 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:40782: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.180
country_id: 99237
description:
2026-01-31 22:14:59 dovecot_login authenticator failed for H=([65.20.250.180]) [65.20.250.180]:57208: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 74.244.12.212
country_id: 2440476
description:
2026-01-31 22:14:55 186513 [Warning] Aborted connection 186513 to db: 'unconnected' user: 'unauthenticated' host: '74.244.12.212' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:14:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim@cofreth.com.my has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:14:16 dovecot_login authenticator failed for H=(0vQLnn8ds7) [185.169.4.188]:51101: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 22:15:01 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:61387: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:15:04 dovecot_login authenticator failed for H=(rPBwSW) [178.16.54.138]:54094: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:15:11 dovecot_login authenticator failed for H=(KOmxAActBM) [185.169.4.188]:58663: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.53.58.10
country_id: 1835841
description:
2026-01-31 22:15:23 dovecot_login authenticator failed for H=([211.53.58.10]) [211.53.58.10]:59971: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:eminent.st.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:dfc6e483b8ec073e833623fcd3b8d303d572f52b||Title:0xe486c7b1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:15:03 dovecot_login authenticator failed for H=(2aT5GAOiN) [185.169.4.188]:54689: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 22:15:02 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:61549: 535 Incorrect authentication data (set_id=testing@aircarbonic.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 74.244.12.212
country_id: 2440476
description:
2026-01-31 22:15:01 186526 [Warning] Aborted connection 186526 to db: 'unconnected' user: 'unauthenticated' host: '74.244.12.212' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.30
country_id: 1269750
description:
2026-01-31 22:15:14 dovecot_login authenticator failed for H=([182.95.119.30]) [182.95.119.30]:35882: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 22:16:03 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:50530: 535 Incorrect authentication data (set_id=testing@symphony-led.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.61.48.234
country_id: 1835841
description:
2026-01-31 22:16:35 dovecot_login authenticator failed for H=([125.61.48.234]) [125.61.48.234]:44721: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 157.230.37.176
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/wpr-addons/forms/b1ack.php||SC:/home/oxboldc/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:16:14 dovecot_login authenticator failed for H=(dWjayRLG) [185.169.4.188]:53726: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.202.101
country_id: 6252001
description:
2026-01-31 22:16:50 dovecot_login authenticator failed for H=([165.154.202.101]) [165.154.202.101]:28814: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:16:16 dovecot_login authenticator failed for H=(39HAN5) [178.16.54.138]:63363: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:16:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:eminent.st.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:23b11b2277287ac341671e728a191c550eadb916||Title:0x2342320f||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:17:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.226.81
country_id: 1835841
description:
2026-01-31 22:17:48 dovecot_login authenticator failed for H=([121.189.226.81]) [121.189.226.81]:48704: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:17:54 dovecot_login authenticator failed for H=(BUHkQ47) [185.169.4.188]:65497: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.36.108
country_id: 3932488
description:
2026-01-31 22:17:57 dovecot_login authenticator failed for H=([190.223.36.108]) [190.223.36.108]:46938: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:17:07 dovecot_login authenticator failed for H=(GPmlfS2) [185.169.4.188]:59844: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:17:19 dovecot_login authenticator failed for H=(TYqBX6wyF) [178.16.54.138]:56756: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.3
country_id: 1814991
description:
2026-01-31 22:17:31 dovecot_login authenticator failed for H=([111.61.177.3]) [111.61.177.3]:44684: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.161.198.136
country_id: 1269750
domain: eminent.st
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:eminent.st.eminent.st||ServerName:eminent.st||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a135a35054d0776481d5cee692f153298006ea27||Title:0xefbfc787||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.213.25.189
country_id: 3175395
domain: vmsmotorsports.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home/vmsadmin/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.31.80.222
country_id: 1814991
description:
2026-01-31 22:17:48 dovecot_login authenticator failed for H=([1.31.80.222]) [1.31.80.222]:46174: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:17:21 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:49532: 535 Incorrect authentication data (set_id=test@box.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:18:39 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky has been locked for the attacker IP 185.169.4.188


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.203.132.68
country_id: 2658434
domain: pftfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home/pftfood/public_html/wp-admin/images/commentv.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:18:09 dovecot_login authenticator failed for H=(MtH2bq) [178.16.54.138]:64523: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:18:11 dovecot_login authenticator failed for H=(QYj8Rl) [185.169.4.188]:56899: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:18:02 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:58503: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:18:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:19:04 dovecot_login authenticator failed for H=(Np3kpi) [185.169.4.188]:63387: 535 Incorrect authentication data (set_id=yennymky)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:19:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2026-01-31 22:19:40 dovecot_login authenticator failed for H=([103.51.26.198]) [103.51.26.198]:59740: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:19:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-31 22:19:54 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:59208: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:19:22 dovecot_login authenticator failed for H=(LdAHEyVjJU) [178.16.54.138]:60966: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.126.179
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=15631516685069 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:20:49 dovecot_login authenticator failed for H=(EanN0q) [185.169.4.188]:51872: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:20:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.241.50
country_id: 1814991
description:
2026-01-31 22:20:24 dovecot_login authenticator failed for H=([218.21.241.50]) [218.21.241.50]:53360: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.203.132.68
country_id: 2658434
domain: pftfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/pftfood/public_html/wp-admin/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.87.152
country_id: 1814991
description:
2026-01-31 22:20:08 dovecot_login authenticator failed for H=([111.61.87.152]) [111.61.87.152]:30322: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:20:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:20:02 dovecot_login authenticator failed for H=(Rug5sjY) [185.169.4.188]:52865: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.89.51
country_id: 660013
description:
2026-01-31 22:20:41 dovecot_login authenticator failed for H=(ADMIN) [188.126.89.51]:27858: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:20:13 dovecot_login authenticator failed for H=(KJRmNA0CD3) [178.16.54.138]:50042: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.88.160.13
country_id: 1814991
description:
2026-01-31 22:20:50 dovecot_login authenticator failed for H=([125.88.160.13]) [125.88.160.13]:51978: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:21:14 dovecot_login authenticator failed for H=(XPjUCZlbCp) [178.16.54.138]:61689: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-01-31 22:21:20 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:43634: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.103.200
country_id: 1668284
description:
2026-01-31 22:21:08 dovecot_login authenticator failed for H=110-25-103-200.adsl.fetnet.net [110.25.103.200]:36710: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:21:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:21:12 dovecot_login authenticator failed for H=(HleUeo4) [185.169.4.188]:58860: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.65.160.234
country_id: 1814991
description:
2026-01-31 22:22:29 dovecot_login authenticator failed for H=([124.65.160.234]) [124.65.160.234]:47647: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
country_id: 272103
description:
2026-01-31 22:22:12 dovecot_login authenticator failed for H=([109.233.21.109]) [109.233.21.109]:39360: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:22:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.73.109.194
country_id: 1269750
description:
2026-01-31 22:22:04 dovecot_login authenticator failed for H=([182.73.109.194]) [182.73.109.194]:44374: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-31 22:22:21 H=([64.89.160.15]) [64.89.160.15]:54550 F=<drdavid00r5@outlook.com> rejected RCPT <mustapa@astlog.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.85
country_id: 337996
description:
2026-01-31 22:22:37 dovecot_login authenticator failed for H=([196.188.187.85]) [196.188.187.85]:40366: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:22:04 dovecot_login authenticator failed for H=(NFu1oWZ) [178.16.54.138]:60479: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:22:21 dovecot_login authenticator failed for H=(8NcwrC) [185.169.4.188]:49596: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:23:14 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:60157: 535 Incorrect authentication data (set_id=testing@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-01-31 22:24:01 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:56042: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.194
country_id: 1269750
description:
2026-01-31 22:23:17 dovecot_login authenticator failed for H=(nsg-corporate-194.230.187.122.airtel.in) [122.187.230.194]:53862: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:23:10 dovecot_login authenticator failed for H=(wGCmB8vxs) [178.16.54.138]:64593: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:23:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:23:09 dovecot_login authenticator failed for H=(EotOFgsfa) [185.169.4.188]:50390: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-01-31 22:23:58 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:52618: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.132.164.25
country_id: 2635167
description:
2026-01-31 22:23:41 dovecot_login authenticator failed for H=(ADMIN) [23.132.164.25]:49425: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2026-01-31 22:24:22 dovecot_login authenticator failed for H=([70.120.1.74]) [70.120.1.74]:49853: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:24:04 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:53822: 535 Incorrect authentication data (set_id=testing@sv3.nocser.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:24:18 dovecot_login authenticator failed for H=(zTfX0rv) [185.169.4.188]:58674: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:24:30 dovecot_login authenticator failed for H=(9TAJ7Kxm) [178.16.54.138]:55277: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-31 22:24:12 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:46053: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:24:19 dovecot_login authenticator failed for H=(ZfUjuyIfLN) [178.16.54.138]:60146: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:25:05 dovecot_login authenticator failed for H=(6myICZ7) [185.169.4.188]:61402: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:25:07 dovecot_login authenticator failed for H=(RDKneUlg) [178.16.54.138]:57133: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.203.106
country_id: 1814991
description:
2026-01-31 22:25:58 dovecot_login authenticator failed for H=([122.225.203.106]) [122.225.203.106]:44596: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.228.195.251
country_id: 1814991
description:
2026-01-31 22:26:06 dovecot_login authenticator failed for H=([116.228.195.251]) [116.228.195.251]:17168: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.225.220
country_id: 1269750
description:
2026-01-31 22:26:33 dovecot_login authenticator failed for H=(nsg-corporate-220.225.187.122.airtel.in) [122.187.225.220]:35720: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-01-31 22:26:29 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:36362: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 22:26:32 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:7046: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
country_id: 1835841
description:
2026-01-31 22:26:55 dovecot_login authenticator failed for H=([118.36.234.156]) [118.36.234.156]:48534: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:26:07 dovecot_login authenticator failed for H=(ycIesFO9NG) [178.16.54.138]:64693: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2026-01-31 22:26:32 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:34164: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:26:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:26:16 dovecot_login authenticator failed for H=(YJzvtkyCx) [185.169.4.188]:54015: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-01-31 22:26:35 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:35944: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-31 22:26:47 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:37666: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.169.82.194
country_id: 935317
description:
2026-01-31 22:26:48 dovecot_login authenticator failed for H=(165-169-82-194.zeop.re) [165.169.82.194]:34215: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-01-31 22:26:07 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:49040: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2026-01-31 22:26:42 dovecot_login authenticator failed for H=([123.129.245.249]) [123.129.245.249]:49681: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 22:26:44 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:53167: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 22:27:03 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:62837: 535 Incorrect authentication data (set_id=test@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:27:27 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.255.50
country_id: 1269750
description:
2026-01-31 22:27:39 dovecot_login authenticator failed for H=([182.95.203.81]) [122.186.255.50]:46700: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:27:09 dovecot_login authenticator failed for H=(pz0xQrFk) [178.16.54.138]:58595: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.159.41.51
country_id: 2017370
description:
2026-01-31 22:27:14 dovecot_login authenticator failed for H=([178.159.41.51]) [178.159.41.51]:35266: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:27:02 dovecot_login authenticator failed for H=(keP9TU) [185.169.4.188]:53838: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.209
country_id: 2542007
description:
2026-01-31 22:27:11 dovecot_login authenticator failed for H=([154.144.255.209]) [154.144.255.209]:44956: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-31 22:27:36 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:59035: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-31 22:27:06 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:60098: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-01-31 22:27:16 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:58727: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.160.29.241
country_id: 1835841
description:
2026-01-31 22:27:27 dovecot_login authenticator failed for H=([112.160.29.241]) [112.160.29.241]:57322: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:28:10 dovecot_login authenticator failed for H=(yIKT7JhJU) [185.169.4.188]:64515: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-01-31 22:28:49 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:48154: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.247.159.106
country_id: 1269750
description:
2026-01-31 22:28:52 dovecot_login authenticator failed for H=([115.247.159.106]) [115.247.159.106]:41620: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:28:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim has been locked for the attacker IP 185.169.4.188


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 57.129.81.225
country_id: 2921044
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/img/img/demos/img/demos/img/photos/index.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-01-31 22:28:32 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:41022: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:28:19 dovecot_login authenticator failed for H=(XuTHo0) [178.16.54.138]:56857: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 22:28:40 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (dencrece) [87.103.126.54]:23309: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:28:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:28:28 dovecot_login authenticator failed for H=(XcV6ymj) [178.16.54.138]:59302: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:29:06 dovecot_login authenticator failed for H=(OsGx0U9bU) [178.16.54.138]:49896: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.223.150.246
country_id: 2963597
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home/indfinitydesign/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.230.165.58
country_id: 1814991
description:
2026-01-31 22:29:26 dovecot_login authenticator failed for H=([183.230.165.58]) [183.230.165.58]:49776: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:29:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.165
country_id: 1835841
description:
2026-01-31 22:30:01 dovecot_login authenticator failed for H=([121.142.146.165]) [121.142.146.165]:60813: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:29:10 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63731: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:29:18 dovecot_login authenticator failed for H=(bq0HWQ9) [185.169.4.188]:56183: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:29:26 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.84.98
country_id: 798544
description:
2026-01-31 22:29:46 dovecot_login authenticator failed for H=(98.84.41.31.ip4.feromedia.eu) [31.41.84.98]:51060: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2026-01-31 22:30:35 dovecot_login authenticator failed for H=(nsg-corporate-36.229.187.122.airtel.in) [122.187.229.36]:36337: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:30:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.223.150.246
country_id: 2963597
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/indfinitydesign/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:30:04 dovecot_login authenticator failed for H=(AUXflEz) [185.169.4.188]:56090: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.46
country_id: 1269750
description:
2026-01-31 22:30:16 dovecot_login authenticator failed for H=([182.95.123.46]) [182.95.123.46]:43702: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:30:18 dovecot_login authenticator failed for H=(SpHwaXJE) [178.16.54.138]:56013: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:30:53 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64536: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:30:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:30:10 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:49437: 535 Incorrect authentication data (set_id=test@mams1.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.80
country_id: 1269750
description:
2026-01-31 22:30:19 dovecot_login authenticator failed for H=([122.187.229.80]) [122.187.229.80]:51721: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.108.13
country_id: 1814991
description:
2026-01-31 22:30:52 dovecot_login authenticator failed for H=([119.6.108.13]) [119.6.108.13]:46402: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 54.248.62.78
country_id: 1861060
domain: sv3.nocser.net
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/backup.sql||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:31:04 dovecot_login authenticator failed for H=(LNQWmglTsZ) [178.16.54.138]:65388: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:31:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:31:18 dovecot_login authenticator failed for H=(kbqkyQtW) [185.169.4.188]:64047: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:32:25 dovecot_login authenticator failed for H=(zwoPVSa4ed) [178.16.54.138]:58937: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.233.181
country_id: 2017370
description:
2026-01-31 22:32:52 dovecot_login authenticator failed for H=(ipoe-static.mosoblast.rt.ru) [89.109.233.181]:37488: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-01-31 22:32:30 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:38834: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.175.199.86
country_id: 2017370
description:
2026-01-31 22:32:52 dovecot_login authenticator failed for H=(bergsound.Moscow.Access.Comstar.ru) [89.175.199.86]:60440: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:32:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:32:05 dovecot_login authenticator failed for H=(IKxsRB5DG) [185.169.4.188]:52471: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.108.13
country_id: 1814991
description:
2026-01-31 22:33:15 dovecot_login authenticator failed for H=([119.6.108.13]) [119.6.108.13]:59483: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:33:19 dovecot_login authenticator failed for H=(Y7tceEH) [185.169.4.188]:59558: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2026-01-31 22:33:10 dovecot_login authenticator failed for H=([183.182.99.92]) [183.182.99.92]:36131: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:33:11 dovecot_login authenticator failed for H=(fxPbIZQw8) [178.16.54.138]:61034: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-01-31 22:33:21 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:53718: 535 Incorrect authentication data (set_id=testing@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-01-31 22:33:32 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:41330: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:34:28 dovecot_login authenticator failed for H=(23357hg) [178.16.54.138]:57065: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:34:05 dovecot_login authenticator failed for H=(ttQfEFiG) [178.16.54.138]:53490: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.163.195
country_id: 3932488
description:
2026-01-31 22:34:43 dovecot_login authenticator failed for H=([200.107.163.195]) [200.107.163.195]:62430: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:34:07 dovecot_login authenticator failed for H=(PMraTWU) [185.169.4.188]:58745: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:34:49 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.123.219.137
country_id: 1835841
description:
2026-01-31 22:35:59 dovecot_login authenticator failed for H=([203.123.219.137]) [203.123.219.137]:60690: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.238
country_id: 1814991
description:
2026-01-31 22:35:05 dovecot_login authenticator failed for H=([1.30.20.238]) [1.30.20.238]:52092: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.159.71.249
country_id: 1835841
description:
2026-01-31 22:35:31 dovecot_login authenticator failed for H=([121.159.71.249]) [121.159.71.249]:40412: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:35:10 dovecot_login authenticator failed for H=(1x0DghuD) [178.16.54.138]:60185: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:35:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:35:17 dovecot_login authenticator failed for H=(uXLcTb) [185.169.4.188]:50907: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-31 22:35:36 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:35178: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.246
country_id: 1814991
description:
2026-01-31 22:35:43 dovecot_login authenticator failed for H=([116.114.84.246]) [116.114.84.246]:43568: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-01-31 22:35:08 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:56792: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-01-31 22:35:08 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:42010: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:35:58 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:65085: 535 Incorrect authentication data (set_id=testing@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:36:04 dovecot_login authenticator failed for H=(Lu2QfpkgQ) [185.169.4.188]:64627: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.28.94.52
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=25 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:36:49 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:36:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:36:15 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:59881: 535 Incorrect authentication data (set_id=testing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.232.126
country_id: 1269750
description:
2026-01-31 22:36:04 dovecot_login authenticator failed for H=(nsg-corporate-126.232.187.122.airtel.in) [122.187.232.126]:53752: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:36:12 dovecot_login authenticator failed for H=(nWqOb8) [178.16.54.138]:60657: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:37:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:37:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:37:07 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:50512: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:37:06 dovecot_login authenticator failed for H=(U3mgYrqYc) [178.16.54.138]:60420: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:37:15 dovecot_login authenticator failed for H=(F7tlLdMsjm) [185.169.4.188]:54777: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 144.31.169.142
country_id: 660013
description:
[2026-01-31 22:37:28 +0800] info [whostmgrd] 144.31.169.142 - nexus2019 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2026-01-31 22:37:59 dovecot_login authenticator failed for H=(46.30.161.197.access.ipnet.ua) [46.30.161.197]:41695: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-31 22:38:27 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64249: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.188
country_id: 2635167
description:
Jan 31 22:38:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim has been locked for the attacker IP 185.169.4.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.188
country_id: 2635167
description:
2026-01-31 22:38:04 dovecot_login authenticator failed for H=(BFpy9Bdex) [185.169.4.188]:55480: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.10.20
country_id: 1814991
description:
2026-01-31 22:38:11 dovecot_login authenticator failed for H=([221.10.10.20]) [221.10.10.20]:56901: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 22:38:48 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:8133: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:38:11 dovecot_login authenticator failed for H=(7UBSExnvF) [178.16.54.138]:59765: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:38:26 dovecot_login authenticator failed for H=(eE9CjYPMjV) [178.16.54.138]:59522: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:38:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:39:08 dovecot_login authenticator failed for H=(e0wY8Bylz) [178.16.54.138]:53603: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.75
country_id: 1269750
description:
2026-01-31 22:39:08 dovecot_login authenticator failed for H=([203.193.147.75]) [203.193.147.75]:57578: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 22:39:18 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:59621: 535 Incorrect authentication data (set_id=testing@aircarbonic.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 22:39:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya@hmz.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:40:14 dovecot_login authenticator failed for H=(RHe64mWLFo) [178.16.54.138]:59881: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.10.20
country_id: 1814991
description:
2026-01-31 22:40:58 dovecot_login authenticator failed for H=([221.10.10.20]) [221.10.10.20]:36612: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-31 22:40:23 H=([64.89.160.15]) [64.89.160.15]:63554 F=<drdavid00r5@outlook.com> rejected RCPT <sales@hmz.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.174.142.122
country_id: 6252001
description:
2026-01-31 22:40:46 dovecot_login authenticator failed for H=(cdqgu) [107.174.142.122]:56385: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-01-31 22:40:31 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:57428: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-01-31 22:40:35 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:47756: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.45.175.196
country_id: 1168579
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Classes/PHPExcel/Worksheet/Dimension.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.212.118.40
country_id: 6252001
description:
2026-01-31 22:41:45 dovecot_login authenticator failed for H=40.sub-97-212-118.myvzw.com [97.212.118.40]:43720: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:41:45 dovecot_login authenticator failed for H=(C3bUZddc31) [178.16.54.138]:59492: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:41:04 dovecot_login authenticator failed for H=(MX6z0C) [178.16.54.138]:58602: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 22:41:11 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:54649: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.151.240.91
country_id: 1522867
description:
2026-01-31 22:41:37 dovecot_login authenticator failed for H=37.151.240.91.dynamic.telecom.kz [37.151.240.91]:51309: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.151
country_id: 2017370
description:
2026-01-31 22:41:40 dovecot_login authenticator failed for H=([178.178.194.151]) [178.178.194.151]:50354: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.57.27.185
country_id: 1643084
description:
2026-01-31 22:41:48 dovecot_login authenticator failed for H=([202.57.27.185]) [202.57.27.185]:50832: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.191.124.201
country_id: 1269750
description:
2026-01-31 22:41:51 dovecot_login authenticator failed for H=([160.191.124.201]) [160.191.124.201]:51729: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 22:42:06 dovecot_login authenticator failed for H=(LKdmlt) [178.16.54.138]:62862: 535 Incorrect authentication data (set_id=miya@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.15.171.148
country_id: 1269750
description:
2026-01-31 22:42:10 dovecot_plain authenticator failed for H=(D5USN7IUSI1V) [47.15.171.148]:53298: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.161.196.5
country_id: 99237
description:
2026-01-31 22:42:05 dovecot_login authenticator failed for H=([46.161.196.5]) [46.161.196.5]:45232: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
country_id: 2017370
description:
2026-01-31 22:43:20 dovecot_login authenticator failed for H=(dynamicip-95-79-108-51.pppoe.nn.ertelecom.ru) [95.79.108.51]:38057: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2026-01-31 22:43:31 dovecot_login authenticator failed for H=(visaotur.sdr.gvt.net.br) [186.215.245.175]:59655: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.71.214.155
country_id: 6252001
description:
2026-01-31 22:43:37 dovecot_login authenticator failed for H=wsip-174-71-214-155.lv.lv.cox.net [174.71.214.155]:57262: 535 Incorrect authentication data (set_id=support)


