# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:56:17 dovecot_login authenticator failed for H=(To9v0QlBm) [2.58.56.77]:53319: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 22:56:28 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35128: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:56:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58084: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 22:56:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 22:56:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.254.249.198
country_id: 3469034
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/pipe-repair.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:56:05 dovecot_login authenticator failed for H=(kKCYDL7jE2) [178.16.52.139]:51364: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:56:09 dovecot_login authenticator failed for H=(Zj5Iz0Ks) [158.94.208.175]:55705: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:56:05 dovecot_login authenticator failed for H=(gspSppJ) [178.16.54.22]:62676: 535 Incorrect authentication data (set_id=alexchan)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 22:56:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:57:02 dovecot_login authenticator failed for H=(u33yy166ko) [158.94.208.175]:54949: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-02-01 22:57:06 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:46630: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-01 22:57:17 H=([167.148.167.71]) [167.148.167.71]:52917 F=<Server@ajplantations.com.my> rejected RCPT <spyong@ajplantations.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:57:23 dovecot_login authenticator failed for H=(fP6Ldi) [178.16.52.139]:58859: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 22:57:38 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:57:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50096: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 22:57:27 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 22:57:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:57:04 dovecot_login authenticator failed for H=(laDgNcZV) [178.16.54.22]:61036: 535 Incorrect authentication data (set_id=fkr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:57:05 dovecot_login authenticator failed for H=(Rjd2ek) [2.58.56.77]:65462: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:57:10 dovecot_login authenticator failed for H=(L6t4Xp) [178.16.54.22]:61834: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 22:58:49 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:40458: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 22:58:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 22:58:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:58:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65355: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 22:58:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:58:22 dovecot_login authenticator failed for H=(bfVElr17jv) [158.94.208.175]:51092: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:58:07 dovecot_login authenticator failed for H=(7SdJkG) [178.16.52.139]:64908: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-02-01 22:58:09 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:52824: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:58:12 dovecot_login authenticator failed for H=(2bVkwhp96) [178.16.54.22]:59287: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:58:17 dovecot_login authenticator failed for H=(Wyfssusc) [2.58.56.77]:59331: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.253.142
country_id: 1814991
description:
2026-02-01 22:58:35 dovecot_login authenticator failed for H=([116.113.253.142]) [116.113.253.142]:53137: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 22:59:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 22:59:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58247: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 22:59:23 dovecot_login authenticator failed for H=(fKG7Qu) [2.58.56.77]:59001: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 22:59:06 dovecot_login authenticator failed for H=(VT9H4S9) [178.16.54.22]:57246: 535 Incorrect authentication data (set_id=alexchan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 22:59:06 dovecot_login authenticator failed for H=(PRMJyZOLg) [178.16.52.139]:63449: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 22:59:14 dovecot_login authenticator failed for H=(94Vh2Mvn) [158.94.208.175]:54688: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:00:23 dovecot_login authenticator failed for H=(SbJ581G) [178.16.52.139]:51651: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:00:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55015: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:00:11 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53449: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 23:00:12 dovecot_login authenticator failed for H=(FklLlI) [2.58.56.77]:52459: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:00:13 dovecot_login authenticator failed for H=(Hu5KZ93H) [178.16.54.22]:64039: 535 Incorrect authentication data (set_id=fkr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:00:06 dovecot_login authenticator failed for H=(awrBKp60) [158.94.208.175]:60552: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-02-01 23:01:51 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:50968: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:01:05 dovecot_login authenticator failed for H=(Cfs18NCG) [178.16.52.139]:52418: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:01:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64709: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:01:09 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:45642: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.151.216.111
country_id: 3469034
description:
2026-02-01 23:01:16 dovecot_login authenticator failed for H=(ADMIN) [179.151.216.111]:30320: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:01:02 dovecot_login authenticator failed for H=(NTg73Hgnpc) [178.16.54.22]:57432: 535 Incorrect authentication data (set_id=fkr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 23:01:21 dovecot_login authenticator failed for H=(0AgVH2) [2.58.56.77]:62239: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.178.134.91
country_id: 1269750
domain: box.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:84445.box.my||ServerName:box.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8a4739c4c0a9bed14a9e2380d24f986a74b68830||Title:0xf23560ab||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:01:21 dovecot_login authenticator failed for H=(F3s902) [158.94.208.175]:56599: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:02:14 dovecot_login authenticator failed for H=(X2Nt1IKY) [178.16.54.22]:53387: 535 Incorrect authentication data (set_id=fkr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-02-01 23:02:22 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:41886: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:02:36 dovecot_login authenticator failed for H=(Q9ntdbd6Qh) [178.16.54.22]:64510: 535 Incorrect authentication data (set_id=alexchan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 23:02:06 dovecot_login authenticator failed for H=(kxracLkX) [2.58.56.77]:55109: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:02:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60548: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:02:08 dovecot_login authenticator failed for H=(RaUcuJjKjg) [178.16.52.139]:60646: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:02:12 dovecot_login authenticator failed for H=(rZ49ooxi) [158.94.208.175]:62579: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 23:03:18 dovecot_login authenticator failed for H=(yERw8z) [2.58.56.77]:51100: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:03:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54917: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:03:21 dovecot_login authenticator failed for H=(nCGH0m6) [178.16.52.139]:50073: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:03:27 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.178.134.91
country_id: 1269750
domain: box.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:30494.box.com.my||ServerName:box.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:858157b80c831bac01b55328853d9fb496540067||Title:0xdc2b6e03||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 23:03:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:03:04 dovecot_login authenticator failed for H=(SIVDI6Yiv4) [158.94.208.175]:54628: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:03:05 dovecot_login authenticator failed for H=(1TeL8cnNUq) [178.16.54.22]:57903: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:03:27 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44648: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 23:04:06 dovecot_login authenticator failed for H=(CkCSfMpTU7) [2.58.56.77]:49636: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:04:14 dovecot_login authenticator failed for H=(tDRv1m) [178.16.54.22]:49654: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:04:21 dovecot_login authenticator failed for H=(0nwRV800Gy) [158.94.208.175]:55717: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/demos/img/img/contact-us.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:04:07 dovecot_login authenticator failed for H=(1dUpdV2) [178.16.52.139]:56533: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:04:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:04:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64920: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.123.109.43
country_id: 732800
description:
2026-02-01 23:04:35 dovecot_login authenticator failed for H=(ADMIN) [93.123.109.43]:42606: 535 Incorrect authentication data (set_id=enquiry@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 23:04:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.184.217.28
country_id: 1562822
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/approach.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:05:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58641: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 23:05:18 dovecot_login authenticator failed for H=(uriYBoYY) [2.58.56.77]:55476: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:05:19 dovecot_login authenticator failed for H=(HL9NlknwSf) [178.16.54.22]:64427: 535 Incorrect authentication data (set_id=alexchan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:05:22 dovecot_login authenticator failed for H=(W26kMh) [178.16.52.139]:58152: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:05:34 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:05:39 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52240: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:05:09 dovecot_login authenticator failed for H=(ccZ4x5o) [178.16.54.22]:60750: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 23:05:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:05:50 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@chs.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:05:36 dovecot_login authenticator failed for H=(j1BJdsfepZ) [158.94.208.175]:53690: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 23:06:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 23:06:06 dovecot_login authenticator failed for H=(r9vtZRWec) [2.58.56.77]:53492: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:06:19 dovecot_login authenticator failed for H=(VnBwDIxU) [178.16.54.22]:60176: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:06:25 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.126
country_id: 1819730
description:
2026-02-01 23:06:30 dovecot_login authenticator failed for H=(223-197-145-126.static.imsbiz.com) [223.197.145.126]:57024: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.31.198
country_id: 1814991
description:
2026-02-01 23:06:34 dovecot_login authenticator failed for H=([60.166.31.198]) [60.166.31.198]:59345: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-02-01 23:06:44 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:59018: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:06:20 dovecot_login authenticator failed for H=(tQnpsr74u6) [178.16.52.139]:61649: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-01 23:06:33 H=([167.148.167.71]) [167.148.167.71]:59071 F=<Server@symphony-led.com> rejected RCPT <symphony@symphony-led.com>: smtp auth required


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:06:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@chs.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.159.71.249
country_id: 1835841
description:
2026-02-01 23:06:25 dovecot_login authenticator failed for H=([121.159.71.249]) [121.159.71.249]:57916: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:06:27 dovecot_login authenticator failed for H=(Sn1HYOdtV) [158.94.208.175]:53378: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.130
country_id: 1269750
description:
2026-02-01 23:06:03 dovecot_login authenticator failed for H=(nsg-corporate-130.230.187.122.airtel.in) [122.187.230.130]:38652: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:06:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55454: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.246
country_id: 1814991
description:
2026-02-01 23:06:08 dovecot_login authenticator failed for H=([116.114.84.246]) [116.114.84.246]:58382: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:07:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 23:07:19 dovecot_login authenticator failed for H=(VciTxqBZ9) [2.58.56.77]:52829: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:07:42 dovecot_login authenticator failed for H=(x5mDnb2bh) [178.16.54.22]:64784: 535 Incorrect authentication data (set_id=alexchan@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:07:54 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:58274: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:07:10 dovecot_login authenticator failed for H=(yBAQqYXa) [178.16.54.22]:65333: 535 Incorrect authentication data (set_id=alexchan@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:07:19 dovecot_login authenticator failed for H=(mJX1tAcxy6) [158.94.208.175]:65112: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:07:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65474: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 23:07:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:07:11 dovecot_login authenticator failed for H=(jo2qGw) [178.16.52.139]:58923: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2026-02-01 23:07:21 dovecot_login authenticator failed for H=([115.240.244.53]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.227.63.227
country_id: 2921044
description:
2026-02-01 23:07:43 dovecot_plain authenticator failed for H=([212.227.63.227]) [212.227.63.227]:56135: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:07:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@chs.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.93.62.202
country_id: 2017370
description:
2026-02-01 23:07:09 dovecot_login authenticator failed for H=80-93-62-202.vps-ptr.clients.spaceweb.ru [80.93.62.202]:40870: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:08:11 dovecot_login authenticator failed for H=(FihIlcFkeB) [158.94.208.175]:58090: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:08:17 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65206: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.242
country_id: 1814991
description:
2026-02-01 23:09:02 dovecot_login authenticator failed for H=([111.61.176.242]) [111.61.176.242]:12800: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.16.99.209
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=500196 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.34
country_id: 1269750
description:
2026-02-01 23:08:45 dovecot_login authenticator failed for H=(nsg-corporate-78.223.187.122.airtel.in) [182.66.214.34]:50992: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:08:14 dovecot_login authenticator failed for H=(Kttx0wUJ5H) [178.16.52.139]:63080: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 23:08:05 dovecot_login authenticator failed for H=(TjqhD9kwX) [2.58.56.77]:59147: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.130.146.31
country_id: 6251999
description:
2026-02-01 23:08:22 dovecot_login authenticator failed for H=31.146.130.34.bc.googleusercontent.com (10.188.0.2) [34.130.146.31]:62538: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:08:23 dovecot_login authenticator failed for H=(5v6pgst) [178.16.54.22]:52988: 535 Incorrect authentication data (set_id=alexchan@fimco.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:08:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@chs.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:09:05 dovecot_login authenticator failed for H=(u6vLn9ft) [178.16.52.139]:61420: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:09:04 dovecot_login authenticator failed for H=(NXx5NDfMtC) [178.16.54.22]:56652: 535 Incorrect authentication data (set_id=alexchan@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 23:09:17 dovecot_login authenticator failed for H=(1QyHsaIv) [2.58.56.77]:56861: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:09:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@chs.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:09:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57858: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:09:03 dovecot_login authenticator failed for H=(XgGniEupF3) [158.94.208.175]:52506: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:10:49 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:10:03 dovecot_login authenticator failed for H=(8XN6OsC) [178.16.52.139]:51776: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:10:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52175: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:10:10 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44290: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 23:10:26 dovecot_login authenticator failed for H=(sWIdAL3khb) [2.58.56.77]:60951: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:10:20 dovecot_login authenticator failed for H=(7ms5Ly8) [158.94.208.175]:61402: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:10:22 dovecot_login authenticator failed for H=(yuIjP6Ybe) [178.16.54.22]:61038: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:10:24 dovecot_login authenticator failed for H=(w3GSWQMH) [178.16.54.22]:54376: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-01 23:10:31 +0800] info [cpaneld] 185.204.54.153 - krisfood "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:11:24 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:11:11 dovecot_login authenticator failed for H=(6DdzdV) [158.94.208.175]:58084: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 23:11:09 dovecot_login authenticator failed for H=(8mU7PL6xl) [2.58.56.77]:60666: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:11:11 dovecot_login authenticator failed for H=(9l1wWQtzr2) [178.16.54.22]:50110: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 23:11:55 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:11:06 dovecot_login authenticator failed for H=(kZpIWR) [178.16.52.139]:57366: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:11:24 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55812: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2e411589f4215c2bc7093644128ce29ebaf7e506||Title:0x8e590c38||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:12:08 dovecot_login authenticator failed for H=(OxXtPcih7) [178.16.54.22]:53320: 535 Incorrect authentication data (set_id=fkr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:12:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64965: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:12:04 dovecot_login authenticator failed for H=(jbia4CxVy) [158.94.208.175]:49943: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 23:12:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:12:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 23:12:20 dovecot_login authenticator failed for H=(2vimbnl3Q) [2.58.56.77]:62320: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:12:22 dovecot_login authenticator failed for H=(ItjFuUgLc3) [178.16.52.139]:65161: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:12:28 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:12:32 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36710: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:12:42 dovecot_login authenticator failed for H=(WzSGJB3ia9) [178.16.54.22]:51083: 535 Incorrect authentication data (set_id=alexchan@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:13:13 dovecot_login authenticator failed for H=(zRYuwSRw) [178.16.52.139]:50650: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:13:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-02-01 23:13:07 dovecot_login authenticator failed for H=(sdiLyuWn9U) [2.58.56.77]:56368: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:13:08 dovecot_login authenticator failed for H=(vYVWwa) [178.16.54.22]:53029: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.50.143.78
country_id: 1814991
description:
2026-02-01 23:13:35 dovecot_login authenticator failed for H=([127.0.0.1]) [111.50.143.78]:26828: 535 Incorrect authentication data (set_id=rafidah@pspoly.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:13:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.209.251.183
country_id: 2661886
description:
2026-02-01 23:13:42 dovecot_login authenticator failed for H=h83-209-251-183.cust.bredband2.com ([127.0.0.1]) [83.209.251.183]:40836: 535 Incorrect authentication data (set_id=rafidah)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a625a89f3bca3623c4bcdf1853496dd6b26a8247||Title:0x825836a0||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:13:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57527: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Feb  1 23:13:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:13:22 dovecot_login authenticator failed for H=(WqL4zLrsh) [158.94.208.175]:58056: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:14:09 dovecot_login authenticator failed for H=(IfJSTnulZm) [178.16.52.139]:59117: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:14:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:14:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:14:14 dovecot_login authenticator failed for H=(yNPoKSJl) [158.94.208.175]:56572: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:14:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55248: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:14:55 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33860: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:14:06 dovecot_login authenticator failed for H=(QXfVQs0rd) [178.16.54.22]:55092: 535 Incorrect authentication data (set_id=alexchan@fimco.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:26eef3712af11cb9ce75bdc07d65176781f165ad||Title:0xe5eb6fc1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-01 23:15:53 H=([167.148.167.71]) [167.148.167.71]:49992 F=<Server@tst-ma.com> rejected RCPT <tst@tst-ma.com>: Sender verify failed


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:15:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:15:06 dovecot_login authenticator failed for H=(978f1bsr) [158.94.208.175]:49391: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:15:07 dovecot_login authenticator failed for H=(R2nXpOx0am) [178.16.54.22]:56655: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:15:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51378: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-02-01 23:15:20 dovecot_plain authenticator failed for H=(valeptes) [102.53.15.180]:37657: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:15:21 dovecot_login authenticator failed for H=(6Gaj4d) [178.16.54.22]:52463: 535 Incorrect authentication data (set_id=fkr)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:15:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:15:05 dovecot_login authenticator failed for H=(hWd05oVV) [178.16.52.139]:56059: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:16:22 dovecot_login authenticator failed for H=(TQbzNcD) [158.94.208.175]:53394: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:16:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60660: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:16:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:16:25 dovecot_login authenticator failed for H=(fn4PI1ZIK5) [178.16.52.139]:63643: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:16:04 dovecot_login authenticator failed for H=(QeASRmJ) [178.16.54.22]:50687: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:17:13 dovecot_login authenticator failed for H=(DPS2M8Z9k) [178.16.54.22]:57149: 535 Incorrect authentication data (set_id=cklee)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:dae9a065e6263494b6ad732f05731b1b95bddd7f||Title:0x523d459d||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:17:22 dovecot_login authenticator failed for H=(LLu7OlUR) [178.16.52.139]:54413: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:17:37 dovecot_login authenticator failed for H=(pmEf5i) [178.16.54.22]:53033: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:17:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56361: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:17:11 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33726: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:17:13 dovecot_login authenticator failed for H=(Xs55OUJy) [158.94.208.175]:63267: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:18:15 dovecot_login authenticator failed for H=(r6wxXf) [178.16.54.22]:62930: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:18:03 dovecot_login authenticator failed for H=(Knjbirj) [158.94.208.175]:49907: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:18:55 dovecot_login authenticator failed for H=(WhBHcC) [178.16.52.139]:60751: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:18:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50924: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:19:16 dovecot_login authenticator failed for H=(7ogbS13Zzy) [178.16.54.22]:62430: 535 Incorrect authentication data (set_id=alexchan@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:19:21 dovecot_login authenticator failed for H=(AP6I92) [178.16.52.139]:65264: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:faf525e74b8abc2152a7cc0ecdf51bf29ccc8659||Title:0xc7c4a3bb||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.154
country_id: 1269750
description:
2026-02-01 23:19:36 dovecot_login authenticator failed for H=(nsg-corporate-1.193.187.122.airtel.in) [182.95.178.154]:47284: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:19:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62497: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:19:20 dovecot_login authenticator failed for H=(KHn7VLQC) [158.94.208.175]:53919: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
country_id: 2510769
description:
2026-02-01 23:19:15 dovecot_login authenticator failed for H=(cm-staticip-85-152-57-60.telecable.es) [85.152.57.60]:52851: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:19:25 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:34232: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:20:35 dovecot_login authenticator failed for H=(pJPms9T) [178.16.54.22]:57963: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:20:10 dovecot_login authenticator failed for H=(U9PQkx) [158.94.208.175]:49727: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:20:16 dovecot_login authenticator failed for H=(AW7ch8e) [178.16.52.139]:52380: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-02-01 23:20:03 +0800] info [cpaneld] 202.178.120.157 - KIk! "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:20:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58514: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:20:06 dovecot_login authenticator failed for H=(1E7nf1e) [178.16.54.22]:57169: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:20:45 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7046a7b3abdf7e0d50a160d85b4a02ffe242e519||Title:0xb6616c3a||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/demos/img/new-development.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:21:03 dovecot_login authenticator failed for H=(Cz9figGb9) [178.16.52.139]:59381: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:21:40 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55456: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:21:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.178.230.115
country_id: 357994
description:
2026-02-01 23:21:49 dovecot_login authenticator failed for H=([41.178.230.115]) [41.178.230.115]:33334: 535 Incorrect authentication data (set_id=admin@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:21:08 dovecot_login authenticator failed for H=(8OtP09aUKw) [178.16.54.22]:53068: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:21:23 dovecot_login authenticator failed for H=(brKDAgX) [158.94.208.175]:49918: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.246.238
country_id: 1814991
description:
2026-02-01 23:21:59 dovecot_login authenticator failed for H=([218.21.246.238]) [218.21.246.238]:40854: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:21:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52346: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:21:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.201.52
country_id: 1814991
description:
2026-02-01 23:22:01 dovecot_login authenticator failed for H=([58.16.201.52]) [58.16.201.52]:39879: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:51d069ac866a0110d4f487c3add1fa602d76ac02||Title:0xa2ed5ff3||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:22:05 dovecot_login authenticator failed for H=(AwsM1Y8j3) [178.16.54.22]:59691: 535 Incorrect authentication data (set_id=alexchan@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-02-01 23:22:37 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:46742: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:22:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:22:12 dovecot_login authenticator failed for H=(7oW7IjrkG) [158.94.208.175]:58742: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.219.80
country_id: 3144096
description:
2026-02-01 23:22:39 dovecot_login authenticator failed for H=([84.210.219.80]) [84.210.219.80]:38409: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.159
country_id: 2750405
description:
2026-02-01 23:22:09 245729 [Warning] Aborted connection 245729 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.159' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:22:14 dovecot_login authenticator failed for H=(6x09bM0Ujt) [178.16.52.139]:50905: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.82
country_id: 1269750
description:
2026-02-01 23:22:19 dovecot_login authenticator failed for H=([59.145.212.121]) [182.95.184.82]:41260: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.188
country_id: 1814991
description:
2026-02-01 23:22:21 dovecot_login authenticator failed for H=([111.61.177.188]) [111.61.177.188]:37626: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:22:39 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:22:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62400: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-02-01 23:22:39 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:55564: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.246.238
country_id: 1814991
description:
2026-02-01 23:22:53 dovecot_login authenticator failed for H=([218.21.246.238]) [218.21.246.238]:50416: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:23:08 dovecot_login authenticator failed for H=(AomE6kOU) [178.16.52.139]:58599: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 204.144.187.196
country_id: 6252001
description:
2026-02-01 23:23:17 dovecot_plain authenticator failed for H=(watingbame) [204.144.187.196]:60234: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:23:25 dovecot_login authenticator failed for H=(8zyi1bVa) [158.94.208.175]:64213: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:23:02 dovecot_login authenticator failed for H=(zTJsFI) [178.16.54.22]:62529: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:23:59 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47294: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:23:09 dovecot_login authenticator failed for H=(Qd9EPA) [178.16.52.139]:51720: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:23:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:23:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56676: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:23:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9754894070a362179b4351f9e2d291b7c7f6405c||Title:0x22135684||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:24:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-01 23:24:13 H=([167.148.167.71]) [167.148.167.71]:59355 F=<Server@nexuscollection.com> rejected RCPT <wankh@nexuscollection.com>: Mail to wankh@nexuscollection.com has been suspended


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:24:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:24:16 dovecot_login authenticator failed for H=(4DO39eb) [178.16.54.22]:54513: 535 Incorrect authentication data (set_id=alexchan@fimco.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 23:24:57 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:24:06 dovecot_login authenticator failed for H=(bz1jRvQQDe) [178.16.52.139]:60767: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:24:13 dovecot_login authenticator failed for H=(Hp84gZXma) [158.94.208.175]:53509: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:24:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54803: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:25:04 dovecot_login authenticator failed for H=(5kOe2I) [178.16.54.22]:62265: 535 Incorrect authentication data (set_id=alexchan@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:25:07 dovecot_login authenticator failed for H=(WXEEWOVpxX) [178.16.52.139]:50254: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:25:49 dovecot_login authenticator failed for H=(NfstmvDr) [178.16.52.139]:51868: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:25:23 dovecot_login authenticator failed for H=(8zkByUvrM) [158.94.208.175]:52229: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:25:24 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56944: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.178.229
country_id: 3865483
description:
2026-02-01 23:25:56 dovecot_login authenticator failed for H=([186.5.178.229]) [186.5.178.229]:48254: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:25:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account euratech@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:25:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/clientele.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:26:06 dovecot_login authenticator failed for H=(EFvQtoovhC) [178.16.54.22]:50189: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:26:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64986: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:26:09 dovecot_login authenticator failed for H=(aqAoX7X) [158.94.208.175]:61617: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:26:13 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54648: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8c7dab9cbc854865a92210dadbef5585b0c4b942||Title:0x777ec7f5||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:26:07 dovecot_login authenticator failed for H=(1NNmh37QJ) [178.16.52.139]:61555: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.129.119.45
country_id: 1814991
description:
2026-02-01 23:26:20 dovecot_login authenticator failed for H=([39.129.119.45]) [39.129.119.45]:53924: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.188
country_id: 1814991
description:
2026-02-01 23:26:33 dovecot_login authenticator failed for H=([111.61.177.188]) [111.61.177.188]:41048: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.159.71.249
country_id: 1835841
description:
2026-02-01 23:26:52 dovecot_login authenticator failed for H=([121.159.71.249]) [121.159.71.249]:38034: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2026-02-01 23:27:30 dovecot_plain authenticator failed for H=c-68-40-189-43.hsd1.mi.comcast.net (activalsk) [68.40.189.43]:59606: 535 Incorrect authentication data (set_id=skgoh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:27:07 dovecot_login authenticator failed for H=(kY457G) [178.16.52.139]:55963: 535 Incorrect authentication data (set_id=euratech@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:27:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58117: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ca43ef0a9d31de4fbbc6151e0291c0cef6146185||Title:0xc7b5a3ac||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:27:05 dovecot_login authenticator failed for H=(pscdl9aE) [178.16.54.22]:65032: 535 Incorrect authentication data (set_id=cklee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:27:20 dovecot_login authenticator failed for H=(st6TUN) [158.94.208.175]:52629: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:28:12 dovecot_login authenticator failed for H=(yIJA9Kc) [178.16.52.139]:59985: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:28:28 dovecot_login authenticator failed for H=(gOtBUyGGiD) [178.16.54.22]:49534: 535 Incorrect authentication data (set_id=cklee)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:28:53 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:28:07 dovecot_login authenticator failed for H=(kq38B2Vq) [158.94.208.175]:60925: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:28:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51016: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:28:16 dovecot_login authenticator failed for H=(XBZymKG2Ab) [178.16.54.22]:63637: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:28:31 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36216: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 23:28:56 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.248.122
country_id: 1269750
description:
2026-02-01 23:29:30 dovecot_login authenticator failed for H=([122.185.248.122]) [122.185.248.122]:56566: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4adccb4c74afa1277da179d43d501b93360d0c43||Title:0x722e7a41||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:29:06 dovecot_login authenticator failed for H=(5G1vkRWQfq) [178.16.52.139]:63594: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:29:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63349: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:29:17 dovecot_login authenticator failed for H=(M7P70akT) [178.16.54.22]:55168: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.38
country_id: 1269750
description:
2026-02-01 23:29:19 dovecot_login authenticator failed for H=([125.18.99.38]) [125.18.99.38]:52788: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.232
country_id: 6252001
description:
2026-02-01 23:29:07 245999 [Warning] Aborted connection 245999 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.232' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.123.109.43
country_id: 732800
description:
2026-02-01 23:29:15 dovecot_login authenticator failed for H=(ADMIN) [93.123.109.43]:49842: 535 Incorrect authentication data (set_id=service@nmahir.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:29:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:29:19 dovecot_login authenticator failed for H=(6Gnt4teFxu) [158.94.208.175]:63039: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:30:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:30:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58108: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:30:12 dovecot_login authenticator failed for H=(8uDQf2VGW) [178.16.52.139]:61929: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:30:47 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52632: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 23:30:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:30:06 dovecot_login authenticator failed for H=(lQelLiz) [178.16.54.22]:53540: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:30:07 dovecot_login authenticator failed for H=(jd7kgH) [158.94.208.175]:51865: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:30:34 dovecot_login authenticator failed for H=(rDNlbxi23k) [178.16.54.22]:58519: 535 Incorrect authentication data (set_id=cklee)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d46397661fa25d7c646e6a49b7ed4ae15526b925||Title:0xd874f5af||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:31:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:31:18 dovecot_login authenticator failed for H=(T70lotTjwA) [178.16.54.22]:63858: 535 Incorrect authentication data (set_id=cklee)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.173
country_id: 2635167
description:
2026-02-01 23:31:49 246077 [Warning] Aborted connection 246077 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.173' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-01 23:31:55 246079 [Warning] Aborted connection 246079 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.252.72.162
country_id: 1562822
description:
2026-02-01 23:31:17 dovecot_login authenticator failed for H=([127.0.0.1]) [222.252.72.162]:52606: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.132.40.46
country_id: 6252001
description:
2026-02-01 23:31:20 dovecot_login authenticator failed for H=([127.0.0.1]) [216.132.40.46]:48333: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:31:19 dovecot_login authenticator failed for H=(EKSFOc) [158.94.208.175]:51039: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 23:31:27 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-02-01 23:31:57 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:4621: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:31:06 dovecot_login authenticator failed for H=(j3f0l9snNO) [178.16.52.139]:52589: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:31:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56394: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:32:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:32:17 dovecot_login authenticator failed for H=(wIa1yzyWM) [178.16.54.22]:56967: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:32:07 dovecot_login authenticator failed for H=(dOZVk5) [178.16.52.139]:62297: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:32:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51851: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:32:07 dovecot_login authenticator failed for H=(gc36PWO7h) [158.94.208.175]:60108: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:33:00 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54552: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 23:32:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.10.20
country_id: 1814991
description:
2026-02-01 23:32:16 dovecot_login authenticator failed for H=([221.10.10.20]) [221.10.10.20]:57369: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:33:06 dovecot_login authenticator failed for H=(pndtWm17gX) [178.16.52.139]:63469: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.141.129
country_id: 1733045
description:
[2026-02-01 23:33:09 +0800] info [webmaild] 113.211.141.129 - s-osada@mckd.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:33:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.237.57.61
country_id: 2017370
description:
2026-02-01 23:33:44 dovecot_login authenticator failed for H=host-85-237-57-61.dsl.sura.ru [85.237.57.61]:43112: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.129.96.2
country_id: 1814991
description:
2026-02-01 23:34:02 dovecot_login authenticator failed for H=([219.129.96.2]) [219.129.96.2]:51921: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:33:03 dovecot_login authenticator failed for H=(5ijH8qm) [178.16.54.22]:56246: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:33:03 dovecot_login authenticator failed for H=(QeOXAEXnU) [178.16.54.22]:59235: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:33:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61448: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:33:18 dovecot_login authenticator failed for H=(tknGg3z) [158.94.208.175]:56164: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0d3412ce951294eba16fdf263975cffd51735c06||Title:0x8e6ea100||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:34:05 dovecot_login authenticator failed for H=(Aeksq9f8) [158.94.208.175]:62938: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:34:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57511: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:34:11 dovecot_login authenticator failed for H=(aaGFvwvotl) [178.16.54.22]:56283: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:34:20 dovecot_login authenticator failed for H=(ZCS6VZ) [178.16.52.139]:58631: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.166.18.0
country_id: 1282988
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=739603 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:35:44 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59426: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:35:15 dovecot_login authenticator failed for H=(2GA8m69aSL) [158.94.208.175]:54217: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:35:16 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46386: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:35:16 dovecot_login authenticator failed for H=(9h5BDD) [178.16.54.22]:58942: 535 Incorrect authentication data (set_id=cklee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:35:16 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52083: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:35:14 dovecot_login authenticator failed for H=(OUIgzDSkeb) [178.16.52.139]:60023: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2e54262bf79ae375ef4374b293961cd5c8aabfca||Title:0xaf12022c||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.243.58
country_id: 1814991
description:
2026-02-01 23:35:54 dovecot_login authenticator failed for H=([218.21.243.58]) [218.21.243.58]:45996: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:36:15 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63328: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:36:25 dovecot_login authenticator failed for H=(pa1JoOrr) [158.94.208.175]:53937: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:08b316917eb7b007d5d55bb9fdd85098f4e7e87f||Title:0x8768e31b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:36:21 dovecot_login authenticator failed for H=(tbzT9Q) [178.16.54.22]:53078: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.241.150.246
country_id: 2017370
description:
2026-02-01 23:36:52 dovecot_login authenticator failed for H=91-241-150-246-dyn.neotele.com.ru [91.241.150.246]:41078: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:36:18 dovecot_login authenticator failed for H=(UjR6QJ) [178.16.52.139]:63106: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:36:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/services/images/sliders/radiation.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:37:32 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 23:37:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:37:52 dovecot_login authenticator failed for H=(aZBmDYz) [178.16.54.22]:63780: 535 Incorrect authentication data (set_id=cklee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:37:19 dovecot_login authenticator failed for H=(7Gh5kEmhQ) [178.16.52.139]:54301: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
country_id: 1814991
description:
2026-02-01 23:37:18 dovecot_login authenticator failed for H=([111.61.177.190]) [111.61.177.190]:55550: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:37:34 dovecot_login authenticator failed for H=(MkZc01MF) [158.94.208.175]:53011: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:37:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58066: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.111.156.168
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=342496 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:37:28 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49272: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:37:11 dovecot_login authenticator failed for H=(ne19AU) [178.16.54.22]:52875: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:38:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54821: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-01 23:38:11 H=([167.148.167.71]) [167.148.167.71]:60115 F=<Server@euratech.com.my> rejected RCPT <zhenwei@euratech.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:38:03 dovecot_login authenticator failed for H=(Nakgfqg) [178.16.52.139]:56023: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.159
country_id: 2750405
description:
2026-02-01 23:38:06 246318 [Warning] Aborted connection 246318 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.159' (This connection closed normally without authentication)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 23:38:41 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:38:43 dovecot_login authenticator failed for H=(y3sLttMq0) [178.16.54.22]:50177: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:38:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:38:21 dovecot_login authenticator failed for H=(PSeaHMIqw) [158.94.208.175]:52352: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:38:59 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@mkmetal.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fa1a9843a4539ccfd3af919c3af58124a7c35e3e||Title:0x4b676ae1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.110.210.233
country_id: 953987
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=34741514886288 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:39:42 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:40250: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:39:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50234: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 23:39:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:39:16 dovecot_login authenticator failed for H=(cvsPOs8pZ) [178.16.54.22]:57193: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:39:40 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@mkmetal.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:39:08 dovecot_login authenticator failed for H=(m8GpEoAHDl) [158.94.208.175]:55134: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:39:25 dovecot_login authenticator failed for H=(nAhJ313vD) [178.16.52.139]:54152: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2026-02-01 23:39:41 dovecot_login authenticator failed for H=(nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:35275: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:39:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-02-01 23:39:13 dovecot_login authenticator failed for H=(175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:56144: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:442d710c746ba012a0cf6866a46c8d108a7bec17||Title:0x5b2c257b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 23:40:41 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:40:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:40:19 dovecot_login authenticator failed for H=(4NBIW5) [158.94.208.175]:59003: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:40:41 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52173: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:40:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@mkmetal.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:40:05 dovecot_login authenticator failed for H=(rYJFHhQ) [178.16.54.22]:54768: 535 Incorrect authentication data (set_id=cklee@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:40:07 dovecot_login authenticator failed for H=(uFRPsK3Av) [178.16.52.139]:58290: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:40:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59354: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:41:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:41:04 dovecot_login authenticator failed for H=(oD47nFO) [178.16.52.139]:56186: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:41:24 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@mkmetal.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:41:55 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41876: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:41:06 dovecot_login authenticator failed for H=(i311fNMs) [158.94.208.175]:53929: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:41:03 dovecot_login authenticator failed for H=(3iGNwoy3) [178.16.54.22]:63499: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:41:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54897: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:32f2c3bb2768c8ee181cd23128de95fddf61c388||Title:0xab6582aa||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:42:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54254: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:42:03 dovecot_login authenticator failed for H=(1BdxFgXqwW) [178.16.54.22]:56502: 535 Incorrect authentication data (set_id=cklee@ktlog.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:42:49 dovecot_login authenticator failed for H=(wOgsK3jXr) [178.16.54.22]:60593: 535 Incorrect authentication data (set_id=cklee@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:42:09 dovecot_login authenticator failed for H=(wzESo2) [178.16.52.139]:55817: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:42:16 dovecot_login authenticator failed for H=(IYkpCgZQ) [158.94.208.175]:59029: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:42:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@mkmetal.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:43:12 dovecot_login authenticator failed for H=(cqyfnNq) [178.16.52.139]:62921: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:43:32 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55739: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6ee1e38078be6a320224c50f7a3784f34df43a7c||Title:0xf2fad102||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:43:03 dovecot_login authenticator failed for H=(jUXhir17Wt) [158.94.208.175]:59926: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:43:12 dovecot_login authenticator failed for H=(FkmdEhoc) [178.16.54.22]:49858: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.152.52.237
country_id: 6252001
description:
Feb  1 23:43:27 sv3 pure-ftpd[1225891]: (?@104.152.52.237) [INFO] New connection from 104.152.52.237


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/about-sinaran-utama-teknologi/images/company.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.173
country_id: 2635167
description:
2026-02-01 23:43:48 246512 [Warning] Aborted connection 246512 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.173' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.210.68
country_id: 732800
description:
2026-02-01 23:44:09 dovecot_plain authenticator failed for H=(orefiry) [46.10.210.68]:45810: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:44:13 dovecot_login authenticator failed for H=(hGkjsag) [178.16.52.139]:58657: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.97.254.98
country_id: 3625428
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/Tests/Fixtures/ChildBundle/Resources HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.225.141.67
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/Tests/Fixtures/ChildBundle/Resources/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:44:36 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:44:15 dovecot_login authenticator failed for H=(zDRj6ZK4t) [158.94.208.175]:59851: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 23:44:36 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:44:07 dovecot_login authenticator failed for H=(8Q5ZQE) [178.16.54.22]:55035: 535 Incorrect authentication data (set_id=cklee@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:44:22 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49369: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:44:11 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39762: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:45:10 dovecot_login authenticator failed for H=(9iIA0sf) [178.16.54.22]:49917: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:45:15 dovecot_login authenticator failed for H=(s4EwdLjrAI) [178.16.52.139]:59074: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:45:01 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50312: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.247.24.116
country_id: 1814991
description:
2026-02-01 23:45:37 dovecot_login authenticator failed for H=([127.0.0.1]) [58.247.24.116]:41986: 535 Incorrect authentication data (set_id=firdaus@essemgroup.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.173
country_id: 2635167
description:
2026-02-01 23:45:30 246573 [Warning] Aborted connection 246573 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.173' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:45:02 dovecot_login authenticator failed for H=(e4nD5nB) [158.94.208.175]:60483: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2461ee9db05f27b6128239c95768d8bd999bcd17||Title:0xd2bf5b4a||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.164.174.192
country_id: 2017370
description:
2026-02-01 23:45:43 dovecot_login authenticator failed for H=([127.0.0.1]) [212.164.174.192]:41659: 535 Incorrect authentication data (set_id=firdaus)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:45:00 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:45:38 dovecot_login authenticator failed for H=(dGE2WsFUw) [178.16.54.22]:52312: 535 Incorrect authentication data (set_id=cklee@ktlog.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 23:45:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.130
country_id: 1269750
description:
2026-02-01 23:46:52 dovecot_login authenticator failed for H=(nsg-corporate-130.230.187.122.airtel.in) [122.187.230.130]:46035: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:46:13 dovecot_login authenticator failed for H=(mcinyleRh) [158.94.208.175]:62031: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.34
country_id: 1269750
description:
2026-02-01 23:46:11 dovecot_login authenticator failed for H=(nsg-corporate-78.223.187.122.airtel.in) [182.66.214.34]:39008: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:46:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63115: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.112.126
country_id: 1269750
description:
2026-02-01 23:46:02 dovecot_login authenticator failed for H=([27.123.112.126]) [27.123.112.126]:59514: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.95.126
country_id: 1814991
description:
2026-02-01 23:46:25 dovecot_login authenticator failed for H=([111.26.95.126]) [111.26.95.126]:33708: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:46:30 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:48214: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
country_id: 1814991
description:
2026-02-01 23:46:37 dovecot_login authenticator failed for H=([111.61.177.190]) [111.61.177.190]:32428: 535 Incorrect authentication data


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:chriss.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3fe9c70ec27009380350eaddbd6de0437e5f2012||Title:0x31ffddb3||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:46:08 dovecot_login authenticator failed for H=(wSuekehT) [178.16.52.139]:59413: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:46:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:46:05 dovecot_login authenticator failed for H=(Tyka7v) [178.16.54.22]:50661: 535 Incorrect authentication data (set_id=cklee@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:47:28 dovecot_login authenticator failed for H=(hi8TWZbz) [178.16.52.139]:54644: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:47:51 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mkmadmin@mkmetal.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:47:07 dovecot_login authenticator failed for H=(AL3mzXS6) [178.16.54.22]:53445: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 23:47:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:47:21 dovecot_login authenticator failed for H=(oHZWGa) [158.94.208.175]:65052: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:47:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60523: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:47:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:47:44 dovecot_login authenticator failed for H=(c0PTf08bq) [178.16.54.22]:63670: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:48:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54504: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:48:27 dovecot_login authenticator failed for H=(GUNZDEN) [178.16.52.139]:52886: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/images/sliders/introduction-service.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:48:25 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mkmadmin@mkmetal.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:chriss.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:62edd68c63fd0237d1cd6786d28360ff0c925c6e||Title:0x2eee30db||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:48:46 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44214: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:48:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:48:08 dovecot_login authenticator failed for H=(M84Gleo9) [158.94.208.175]:56285: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-02-01 23:48:20 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:45876: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.222
country_id: 1819730
description:
2026-02-01 23:48:11 dovecot_login authenticator failed for H=222.42.246.220.static.netvigator.com [220.246.42.222]:53007: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:48:18 dovecot_login authenticator failed for H=(LF7jc8) [178.16.54.22]:51977: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.152.52.202
country_id: 6252001
description:
Feb  1 23:48:35 sv3 pure-ftpd[1228952]: (?@104.152.52.202) [INFO] New connection from 104.152.52.202


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.159
country_id: 2750405
description:
2026-02-01 23:49:09 246706 [Warning] Aborted connection 246706 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.159' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:49:12 dovecot_login authenticator failed for H=(mm3dEzaXxq) [178.16.54.22]:62356: 535 Incorrect authentication data (set_id=alexchan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:49:19 dovecot_login authenticator failed for H=(r50fw2rK) [158.94.208.175]:54837: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:49:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52932: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:49:19 dovecot_login authenticator failed for H=(E67XUYfK4O) [178.16.52.139]:54784: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:49:24 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mkmadmin@mkmetal.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/demos/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:50:02 dovecot_login authenticator failed for H=(n0xm3bmZfw) [178.16.54.22]:53463: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:50:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mkmadmin@mkmetal.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:50:07 dovecot_login authenticator failed for H=(XBAvOw5WXe) [178.16.52.139]:59128: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:51:00 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44166: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:50:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61818: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.243
country_id: 1814991
description:
2026-02-01 23:50:51 dovecot_login authenticator failed for H=([111.61.176.243]) [111.61.176.243]:46270: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:50:53 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53122: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:50:06 dovecot_login authenticator failed for H=(3pdRmqA) [158.94.208.175]:53231: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:chriss.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:750e9d2d9172633731e6ebbc7730dbcbae16b058||Title:0x9967a4dd||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.248.4.85
country_id: 1269750
description:
2026-02-01 23:50:34 dovecot_login authenticator failed for H=([115.248.153.209]) [115.248.4.85]:56726: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 23:51:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mkmadmin@mkmetal.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:51:12 dovecot_login authenticator failed for H=(K2fHzPn1) [178.16.54.22]:61531: 535 Incorrect authentication data (set_id=alexchan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:51:14 dovecot_login authenticator failed for H=(0Hn9qI8PFT) [158.94.208.175]:56968: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:51:17 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57635: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/languages/images/sliders/contact.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:51:05 dovecot_login authenticator failed for H=(Zvf7h2) [178.16.52.139]:56442: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2026-02-01 23:51:25 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:51819: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:chriss.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:aab13750213b2fc666eff863a188e0e156378e30||Title:0xb6f56c21||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.185.43.146
country_id: 1643084
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/category/android/images/logo-(3).png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.0.119.223
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/category/android/images/logo.png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:52:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53481: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 23:52:24 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:52:51 dovecot_login authenticator failed for H=(fvRggk) [178.16.54.22]:59957: 535 Incorrect authentication data (set_id=cklee@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:52:09 dovecot_login authenticator failed for H=(ljV45F) [178.16.54.22]:59581: 535 Incorrect authentication data (set_id=cklee@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-01 23:52:23 dovecot_login authenticator failed for H=(6QFO7caJv) [69.5.189.21]:54190: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:52:23 dovecot_login authenticator failed for H=(ob991w) [158.94.208.175]:52949: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.111.237.60
country_id: 1210997
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/category/android/images/banner3.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.47.149.111
country_id: 587116
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/category/android/images/banner1.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:52:10 dovecot_login authenticator failed for H=(qSWwuoQm) [178.16.52.139]:53509: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:52:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.60.131.89
country_id: 1269750
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/category/android/images/banner2.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/about.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:53:10 dovecot_login authenticator failed for H=(OmmuQzG) [158.94.208.175]:63229: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:53:15 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44644: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:chriss.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c4ea8ffcd1e80097d48c1091eaa3d27df71c0721||Title:0x7977c313||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
country_id: 1814991
description:
2026-02-01 23:53:46 dovecot_login authenticator failed for H=([39.165.183.70]) [39.165.183.70]:36058: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:53:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-01 23:53:10 dovecot_login authenticator failed for H=(HmRHiMxV8) [69.5.189.21]:62202: 535 Incorrect authentication data (set_id=kasim_kn)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:53:15 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62688: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:53:19 dovecot_login authenticator failed for H=(DjW0e74HEt) [178.16.54.22]:52154: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.100.88
country_id: 1814991
description:
2026-02-01 23:53:28 dovecot_login authenticator failed for H=([111.26.100.88]) [111.26.100.88]:60194: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:53:05 dovecot_login authenticator failed for H=(1EfZQs) [178.16.52.139]:55056: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/sitemap.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:54:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:54:21 dovecot_login authenticator failed for H=(kS41LsvmK) [158.94.208.175]:50555: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:54:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52733: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:54:11 dovecot_login authenticator failed for H=(STKP2YUvp) [178.16.52.139]:64654: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-01 23:54:19 dovecot_login authenticator failed for H=(NBqvG6dDd) [69.5.189.21]:57063: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:54:07 dovecot_login authenticator failed for H=(gwOI845yKk) [178.16.54.22]:51010: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:55:30 dovecot_login authenticator failed for H=(Fl8DZbaD) [178.16.54.22]:63946: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:55:09 dovecot_login authenticator failed for H=(s1prmFk) [158.94.208.175]:57066: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:55:37 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53096: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:chriss.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:29655a7dde5d745053c24d634b386737347f2569||Title:0xe3c8ae6a||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:55:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:55:22 dovecot_login authenticator failed for H=(wSek2u) [178.16.54.22]:60834: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-01 23:55:06 dovecot_login authenticator failed for H=(isbin4zE) [69.5.189.21]:64647: 535 Incorrect authentication data (set_id=kasim_kn)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:55:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64857: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:55:25 dovecot_login authenticator failed for H=(wEgqRWTn6) [178.16.52.139]:51810: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/about-sinaran-utama-teknologi/images/cdn-cgi/l/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-02-01 23:56:10 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:37580: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-02-01 23:56:22 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:39434: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-01 23:56:15 dovecot_login authenticator failed for H=(U8xCYe) [69.5.189.21]:59727: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:56:22 dovecot_login authenticator failed for H=(XqZ5Kw) [178.16.52.139]:54588: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 23:56:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:chriss.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:08609d5cf5b693f39f031337b08599044bfaca1f||Title:0xa837d520||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:56:02 dovecot_login authenticator failed for H=(O8d5HGJN6p) [178.16.54.22]:50837: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:56:22 dovecot_login authenticator failed for H=(A6PUGayRj8) [158.94.208.175]:55566: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:56:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61136: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:57:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52508: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350197
name: IM360 WAF: Essential Addons for Elementor < 5.7.2 - Vulnerable version discovery (CVE-2023-32243)
abuser: 45.156.128.165
country_id: 2264397
domain: agpc.org.my
description:
IM360 WAF: Essential Addons for Elementor < 5.7.2 - Vulnerable version discovery (CVE-2023-32243)||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-01 23:57:03 dovecot_login authenticator failed for H=(fk6QPR) [69.5.189.21]:51297: 535 Incorrect authentication data (set_id=kasim_kn)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
country_id: 2542007
description:
2026-02-01 23:57:15 dovecot_login authenticator failed for H=([154.144.255.210]) [154.144.255.210]:46662: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: modsec
rule: 77350639
name: IM360 WAF: Suspicious access attempt to WordPress debug.log (CVE-2024-44000)
abuser: 45.156.128.164
country_id: 2264397
domain: agpc.org.my
description:
IM360 WAF: Suspicious access attempt to WordPress debug.log (CVE-2024-44000)||MV:/wp-content/plugins/litespeed-cache/readme.txt||WPU:||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 23:57:52 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51748: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:57:02 dovecot_login authenticator failed for H=(K3ecaWhP) [178.16.54.22]:63811: 535 Incorrect authentication data (set_id=alexchan@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:57:08 dovecot_login authenticator failed for H=(EXTI8J3w7) [178.16.52.139]:58000: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:57:10 dovecot_login authenticator failed for H=(Fch6Sz) [158.94.208.175]:59920: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.177.204.4
country_id: 1269750
description:
2026-02-01 23:57:27 dovecot_login authenticator failed for H=([103.177.204.4]) [103.177.204.4]:41992: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:58:06 dovecot_login authenticator failed for H=(56zd2pI2T) [178.16.54.22]:60549: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:chriss.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4264800cb62c3a1469ee7cb31ee1a45ff47b4e1f||Title:0x824a6466||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:58:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64798: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:58:16 dovecot_login authenticator failed for H=(4JJKzAxiV) [178.16.52.139]:54530: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:58:20 dovecot_login authenticator failed for H=(TncDSi) [158.94.208.175]:58411: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:58:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57809: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 136.228.132.70
country_id: 1831722
domain: nobledec.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:2622' ORDER BY 15-- ||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.147
country_id: 6252001
description:
Feb  1 23:59:02 sv3 pure-ftpd[1234508]: (?@205.210.31.147) [INFO] New connection from 205.210.31.147


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 23:59:06 dovecot_login authenticator failed for H=(4juAC8Xk) [158.94.208.175]:49700: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 23:59:08 dovecot_login authenticator failed for H=(ouw8Bet) [178.16.54.22]:62040: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 23:59:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59713: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 23:59:22 dovecot_login authenticator failed for H=(9TRgTn) [178.16.52.139]:62581: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.255.160.22
country_id: 6252001
description:
2026-02-01 23:59:25 dovecot_login authenticator failed for H=([127.0.0.1]) [173.255.160.22]:49058: 535 Incorrect authentication data (set_id=info@trident-water.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:chriss.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e0339b471ff9cbf434de142f41730b9c20b8f474||Title:0x51769f06||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.179.171.14
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:64373.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a1e4c3f9372f9d6a1a8f374762516f4861963b7e||Title:0x3833b60f||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:00:15 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58899: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:00:34 dovecot_login authenticator failed for H=(XGwRAh3ulj) [178.16.52.139]:53983: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 00:00:08 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55030: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 136.228.132.70
country_id: 1831722
domain: nobledec.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:2622' ORDER BY 10-- ||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 20.169.78.165
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/root/lib/tmpfiles.d/systemd.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:00:18 dovecot_login authenticator failed for H=(WzsAOJQTO8) [158.94.208.175]:50971: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-02-02 00:00:45 dovecot_plain authenticator failed for H=host-196-47-172-253.afnet.net (ilmed) [196.47.172.253]:58456: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:00:14 dovecot_login authenticator failed for H=(iU7RLiDt) [178.16.54.22]:58399: 535 Incorrect authentication data (set_id=corporate_chaah)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:chriss.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1957548e9572d9011c56af7e92e68ad589315ae9||Title:0xae20ffd3||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:01:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60502: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 00:01:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:01:06 dovecot_login authenticator failed for H=(bVQCL1qdN) [158.94.208.175]:60209: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:01:17 dovecot_login authenticator failed for H=(O0ax5SeKw7) [178.16.54.22]:56437: 535 Incorrect authentication data (set_id=alexchan@fimco.com.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 136.228.132.70
country_id: 1831722
domain: nobledec.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:2622' ORDER BY 20-- ||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.28.253
country_id: 1814991
description:
2026-02-02 00:01:09 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.28.253]:52422: 535 Incorrect authentication data (set_id=mjason11@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.230.108.124
country_id: 1835841
description:
2026-02-02 00:01:17 dovecot_login authenticator failed for H=([127.0.0.1]) [155.230.108.124]:44418: 535 Incorrect authentication data (set_id=mjason11)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:01:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58393: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:01:07 dovecot_login authenticator failed for H=(8U5H6e) [178.16.52.139]:57851: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.5.20.165
country_id: 6252001
description:
[2026-02-02 00:02:44 +0800] info [cpaneld] 73.5.20.165 - printspec "GET /login/?login_only=1&user=printspec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user printspec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.107.41.204
country_id: 6252001
description:
[2026-02-02 00:02:55 +0800] info [cpaneld] 76.107.41.204 - print "GET /login/?login_only=1&user=print&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user print (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.48.63.18
country_id: 6252001
description:
[2026-02-02 00:02:16 +0800] info [cpaneld] 98.48.63.18 - printspecsoluti "GET /login/?login_only=1&user=printspecsoluti&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user printspecsoluti (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.81.176.69
country_id: 6252001
description:
[2026-02-02 00:02:18 +0800] info [cpaneld] 73.81.176.69 - printspecsolut "GET /login/?login_only=1&user=printspecsolut&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user printspecsolut (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.178.239.188
country_id: 6252001
description:
[2026-02-02 00:02:21 +0800] info [cpaneld] 104.178.239.188 - printspecsol "GET /login/?login_only=1&user=printspecsol&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user printspecsol (has_cpuser_file failed)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 45.227.254.155
country_id: 3703430
description:
2026-02-02  0:02:22 247379 [Warning] Aborted connection 247379 to db: 'unconnected' user: 'unauthenticated' host: '45.227.254.155' (This connection closed normally without authentication)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.63.244.108
country_id: 6252001
description:
[2026-02-02 00:02:56 +0800] info [cpaneld] 174.63.244.108 - prin "GET /login/?login_only=1&user=prin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user prin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:02:17 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53584: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.23.162.143
country_id: 6252001
description:
[2026-02-02 00:02:23 +0800] info [cpaneld] 173.23.162.143 - printspecso "GET /login/?login_only=1&user=printspecso&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user printspecso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.219.250.187
country_id: 6252001
description:
[2026-02-02 00:02:52 +0800] info [cpaneld] 76.219.250.187 - prints "GET /login/?login_only=1&user=prints&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user prints (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.159.196.163
country_id: 6252001
description:
[2026-02-02 00:02:08 +0800] info [cpaneld] 98.159.196.163 - printspecsolution "GET /login/?login_only=1&user=printspecsolution&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user printspecsolution (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 00:02:21 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38172: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:02:17 dovecot_login authenticator failed for H=(jHybU77IDD) [178.16.54.22]:52803: 535 Incorrect authentication data (set_id=cklee@ktlog.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.188.52
country_id: 6252001
description:
[2026-02-02 00:02:31 +0800] info [cpaneld] 172.56.188.52 - printspecs "GET /login/?login_only=1&user=printspecs&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user printspecs (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:02:14 dovecot_login authenticator failed for H=(26E2F0) [178.16.52.139]:64304: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 00:02:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.164.124.116
country_id: 6252001
description:
[2026-02-02 00:03:00 +0800] info [cpaneld] 47.164.124.116 - pr "GET /login/?login_only=1&user=pr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.33.234
country_id: 6252001
description:
[2026-02-02 00:02:10 +0800] info [cpaneld] 172.56.33.234 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.184.92.45
country_id: 6252001
description:
[2026-02-02 00:02:14 +0800] info [cpaneld] 104.184.92.45 - printspecsolutio "GET /login/?login_only=1&user=printspecsolutio&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.29.172
country_id: 4566966
description:
[2026-02-02 00:02:47 +0800] info [cpaneld] 172.59.29.172 - printspe "GET /login/?login_only=1&user=printspe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user printspe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.2.215
country_id: 6252001
description:
[2026-02-02 00:02:50 +0800] info [cpaneld] 129.222.2.215 - printsp "GET /login/?login_only=1&user=printsp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user printsp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.231.145.61
country_id: 6252001
description:
[2026-02-02 00:02:58 +0800] info [cpaneld] 76.231.145.61 - pri "GET /login/?login_only=1&user=pri&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pri (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-02-02 00:03:01 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:42474: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.66.244.46
country_id: 6252001
description:
[2026-02-02 00:02:12 +0800] info [cpaneld] 108.66.244.46 - printspecsolutioncom "GET /login/?login_only=1&user=printspecsolutioncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user printspecsolutioncom (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:02:17 dovecot_login authenticator failed for H=(kMmdTJk) [158.94.208.175]:50672: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.62.86.44
country_id: 6252001
description:
[2026-02-02 00:02:20 +0800] info [cpaneld] 71.62.86.44 - printspecsolu "GET /login/?login_only=1&user=printspecsolu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user printspecsolu (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:03:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62590: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2026-02-02 00:03:20 dovecot_plain authenticator failed for H=c-24-1-200-187.hsd1.il.comcast.net (brieliate) [24.1.200.187]:47022: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:03:13 dovecot_login authenticator failed for H=(SgNrZ1D) [178.16.54.22]:61040: 535 Incorrect authentication data (set_id=cklee@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:03:17 dovecot_login authenticator failed for H=(Kyy45X) [178.16.52.139]:57203: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-02-02 00:03:47 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:34174: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.232.161.15
country_id: 1814991
description:
2026-02-02 00:04:00 dovecot_login authenticator failed for H=([116.232.161.15]) [116.232.161.15]:65200: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:chriss.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a878fb0faf991cfa41bd71bcf7bb6e61cd56ec99||Title:0x388080d4||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:03:04 dovecot_login authenticator failed for H=(VkcmwaGX) [158.94.208.175]:50676: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.251.197.46
country_id: 1814991
description:
2026-02-02 00:03:37 dovecot_login authenticator failed for H=([101.251.197.46]) [101.251.197.46]:38930: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.162.249.178
country_id: 6252001
description:
[2026-02-02 00:03:02 +0800] info [cpaneld] 68.162.249.178 - printsp1 "GET /login/?login_only=1&user=printsp1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user printsp1 (has_cpuser_file failed)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 57.129.81.227
country_id: 2921044
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/img/demos/img/img/img/photos/about.php||SC:/home2/pspolycom/public_html/img/img||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 136.228.132.70
country_id: 1831722
domain: nobledec.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:2622' ORDER BY 19-- ||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 00:03:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:04:09 dovecot_login authenticator failed for H=(TIpg3Sccxp) [178.16.52.139]:65025: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:04:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55856: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:04:13 dovecot_login authenticator failed for H=(1r21gsYu) [158.94.208.175]:55611: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:04:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58783: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 00:04:33 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:37188: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:chriss.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:72bb9fe722550557c6da48923dd91b891533e236||Title:0x1bb1f2e2||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 00:04:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2026-02-02 00:04:32 dovecot_login authenticator failed for H=([169.211.232.182]) [169.211.232.182]:44214: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:04:10 dovecot_login authenticator failed for H=(wJKTlzILG) [178.16.54.22]:56971: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 00:05:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:05:23 dovecot_login authenticator failed for H=(Q9MiCH) [158.94.208.175]:60557: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 77.52.17.114
country_id: 690791
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/Tests/File/Fixtures/directory HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:05:02 dovecot_login authenticator failed for H=(RPPH9iEfr) [178.16.54.22]:63737: 535 Incorrect authentication data (set_id=cklee@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:05:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53171: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:05:18 dovecot_login authenticator failed for H=(kMic5jH8) [178.16.52.139]:64748: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 00:05:50 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mkmadmin@mkmetal.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-02-02 00:06:00 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:39958: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.178.187.5
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/Tests/File/Fixtures/directory/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:06:09 dovecot_login authenticator failed for H=(QrVL25Hv) [158.94.208.175]:59096: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:06:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49292: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 00:06:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mkmadmin@mkmetal.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2026-02-02 00:06:22 dovecot_login authenticator failed for H=([221.209.48.204]) [221.209.48.203]:40058: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:chriss.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cfa1fe0bba12cad1684befbd24b2dc4f66466e44||Title:0x185d310c||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-02-02 00:06:28 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:47970: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:06:03 dovecot_login authenticator failed for H=(3DQyEN) [178.16.54.22]:55579: 535 Incorrect authentication data (set_id=cklee@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:06:21 dovecot_login authenticator failed for H=(WvU4hA7jP) [178.16.52.139]:52844: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 00:06:45 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59710: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:07:20 dovecot_login authenticator failed for H=(cm7JiRUhsw) [158.94.208.175]:53720: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2026-02-02 00:07:23 dovecot_login authenticator failed for H=([122.187.229.36]) [122.187.229.36]:34737: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
country_id: 1814991
description:
2026-02-02 00:07:03 dovecot_login authenticator failed for H=([116.113.254.26]) [116.113.254.26]:54748: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.174
country_id: 1269750
description:
2026-02-02 00:07:54 dovecot_login authenticator failed for H=([182.95.124.174]) [182.95.124.174]:35834: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:07:03 dovecot_login authenticator failed for H=(ATOU5NO) [178.16.54.22]:57097: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:07:16 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60032: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:07:16 dovecot_login authenticator failed for H=(u43uq9CyHm) [178.16.52.139]:54477: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2026-02-02 00:07:28 dovecot_login authenticator failed for H=69-172-79-198.static.imsbiz.com (173-248-234-145.static.imsbiz.com) [69.172.79.198]:56467: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:07:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60033: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 00:07:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mkmadmin@mkmetal.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-02-02 00:07:14 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:36794: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2026-02-02 00:07:40 dovecot_login authenticator failed for H=([125.17.225.97]) [182.95.61.82]:42336: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 00:09:00 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52366: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-02-02 00:08:26 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:48028: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:08:07 dovecot_login authenticator failed for H=(F885TQNuh) [178.16.52.139]:64436: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 00:08:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mkmadmin@mkmetal.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.108.13
country_id: 1814991
description:
2026-02-02 00:08:35 dovecot_login authenticator failed for H=([119.6.108.13]) [119.6.108.13]:49563: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:chriss.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0ddb7f49b937c994896615f4c79795f398138290||Title:0x5e10a67a||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:08:07 dovecot_login authenticator failed for H=(0u6jaWl) [178.16.54.22]:53811: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:08:07 dovecot_login authenticator failed for H=(LzNHgZwT) [158.94.208.175]:54174: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:08:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53870: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:09:02 dovecot_login authenticator failed for H=(Ufx1S8Q) [178.16.52.139]:62907: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.39.82
country_id: 1814991
description:
2026-02-02 00:09:54 dovecot_login authenticator failed for H=([60.174.39.82]) [60.174.39.82]:41538: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-02-02 00:09:04 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:40768: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:09:08 dovecot_login authenticator failed for H=(Hhk0MPKIIE) [178.16.54.22]:61696: 535 Incorrect authentication data (set_id=cklee)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:chriss.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:485c3c614ba1510078f0370a8bd1a4b2224cd8ab||Title:0xb45af3dd||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.118
country_id: 1814991
description:
2026-02-02 00:09:04 dovecot_login authenticator failed for H=([111.61.175.118]) [111.61.175.118]:62792: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:09:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51415: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:09:19 dovecot_login authenticator failed for H=(JzCHhdo6QL) [158.94.208.175]:52989: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 00:09:40 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 00:09:41 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mkmadmin@mkmetal.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:10:02 dovecot_login authenticator failed for H=(zhXy2KPyY) [178.16.52.139]:55155: 535 Incorrect authentication data (set_id=leong@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:10:06 dovecot_login authenticator failed for H=(iznS5HPA) [158.94.208.175]:55369: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:10:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61958: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2026-02-02 00:10:45 dovecot_login authenticator failed for H=net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:39663: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.213
country_id: 1269750
description:
2026-02-02 00:10:06 dovecot_login authenticator failed for H=(nsg-corporate-213.230.187.122.airtel.in) [122.187.230.213]:54833: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:10:15 dovecot_login authenticator failed for H=(ONhiTQ) [178.16.54.22]:52950: 535 Incorrect authentication data (set_id=alexchan@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:10:24 dovecot_login authenticator failed for H=(aUWJgH) [178.16.52.139]:59142: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.0.3
country_id: 3469034
description:
2026-02-02 00:10:25 dovecot_login authenticator failed for H=(177-174-0-3.user.vivozap.com.br) [177.174.0.3]:54537: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.42.47.150
country_id: 1835841
description:
2026-02-02 00:10:41 dovecot_login authenticator failed for H=([14.42.47.150]) [14.42.47.150]:1935: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.217.180.34
country_id: 1835841
domain: aircarbonic.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/aircarbonicadmin/public_html/wp-includes||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 00:10:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 00:11:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:11:02 dovecot_login authenticator failed for H=(kjISZ59nUH) [178.16.54.22]:61298: 535 Incorrect authentication data (set_id=alexchan@fimco.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:chriss.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d493a8b8259101b0b6a7551b530b8074082ee6cf||Title:0x45eabf44||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:11:08 dovecot_login authenticator failed for H=(BAT4vv8Yf) [178.16.52.139]:49669: 535 Incorrect authentication data (set_id=leong@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 00:11:14 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47436: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2026-02-02 00:11:49 dovecot_login authenticator failed for H=(vtx-b-124-014.virtex.com.br) [179.125.124.14]:45985: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:11:01 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55886: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:11:15 dovecot_login authenticator failed for H=(k0TNGY2dIv) [158.94.208.175]:51310: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.213
country_id: 1269750
description:
2026-02-02 00:11:20 dovecot_login authenticator failed for H=(nsg-corporate-213.230.187.122.airtel.in) [122.187.230.213]:36644: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-02-02 00:11:53 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:46797: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:12:18 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50504: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-02-02 00:12:55 dovecot_plain authenticator failed for H=(asiddety) [12.150.243.22]:22269: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:chriss.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1d3f01bf21714619487fc087dfa92766ec69d448||Title:0x9c29c3d5||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
country_id: 1835841
description:
2026-02-02 00:12:06 dovecot_login authenticator failed for H=([183.99.89.74]) [183.99.89.74]:56646: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:12:02 dovecot_login authenticator failed for H=(XcILjR) [158.94.208.175]:58995: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:12:10 dovecot_login authenticator failed for H=(Rtx5CV8) [178.16.54.22]:50796: 535 Incorrect authentication data (set_id=cklee)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:12:44 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58387: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:12:08 dovecot_login authenticator failed for H=(wOkNmAmHH) [178.16.52.139]:56447: 535 Incorrect authentication data (set_id=leong@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.82
country_id: 1269750
description:
2026-02-02 00:12:24 dovecot_login authenticator failed for H=(nsg-corporate-82.230.187.122.airtel.in) [122.187.230.82]:35520: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 00:12:24 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 00:13:27 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38274: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:13:01 dovecot_login authenticator failed for H=(eVZeZ7) [178.16.54.22]:58164: 535 Incorrect authentication data (set_id=alexchan@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-02 00:13:02 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:38140: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:13:03 dovecot_login authenticator failed for H=(J1AVCDODUd) [178.16.52.139]:49439: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:13:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62476: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 00:13:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:13:13 dovecot_login authenticator failed for H=(1qqNMORsu) [158.94.208.175]:56990: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 136.228.132.70
country_id: 1831722
domain: nobledec.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:2622'UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15-- ||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.181.181
country_id: 1831722
description:
2026-02-02 00:14:26 dovecot_login authenticator failed for H=([36.37.181.181]) [36.37.181.181]:45266: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-02-02 00:14:30 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:59785: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.116.66
country_id: 1269750
description:
2026-02-02 00:14:37 dovecot_login authenticator failed for H=([182.95.116.66]) [182.95.116.66]:45542: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:14:01 dovecot_login authenticator failed for H=(4CvN2a2a) [158.94.208.175]:60784: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-02-02 00:14:06 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:33219: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:14:13 dovecot_login authenticator failed for H=(3WFa0369HP) [178.16.52.139]:51274: 535 Incorrect authentication data (set_id=leong@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:14:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61614: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:14:14 dovecot_login authenticator failed for H=(ljybPej) [178.16.54.22]:61088: 535 Incorrect authentication data (set_id=alexchan@fimco.com.my)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.36.97
country_id: 1880251
description:
Feb  2 00:14:38 sv3 pure-ftpd[1244666]: (?@47.84.36.97) [WARNING] Authentication failed for user [woodlinetrd@gmail.com]


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 00:14:46 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account leong@ktlog.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:chriss.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:15e481e35985a275cedac2770bf6c57da67594e3||Title:0x2e7a4781||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 136.228.132.70
country_id: 1831722
domain: nobledec.com
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:2622'union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15-- ||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:15:10 dovecot_login authenticator failed for H=(963lUH) [158.94.208.175]:50989: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:15:11 dovecot_login authenticator failed for H=(tNUrYXw) [178.16.52.139]:50927: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:15:18 dovecot_login authenticator failed for H=(4wWwVG4) [178.16.54.22]:64175: 535 Incorrect authentication data (set_id=cklee)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 00:15:27 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account leong@ktlog.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 162.216.16.109
country_id: 6252001
domain: fkr.com.my
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:7.71||T:APACHE||REQUEST_URI:/wp-content/plugins/post-smtp/readme.txt||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:15:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54245: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 00:15:39 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55838: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:15:43 dovecot_login authenticator failed for H=(LNv0nbb8) [178.16.54.22]:56130: 535 Incorrect authentication data (set_id=alexchan@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:16:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64077: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:16:21 dovecot_login authenticator failed for H=(YrUCVQHH) [158.94.208.175]:56830: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.160.105.66
country_id: 1814991
description:
2026-02-02 00:16:56 dovecot_login authenticator failed for H=([61.160.105.66]) [61.160.105.66]:58828: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:16:01 dovecot_login authenticator failed for H=(9RWwrd2wP) [178.16.54.22]:56324: 535 Incorrect authentication data (set_id=cklee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:16:13 dovecot_login authenticator failed for H=(H9mT9zMqG) [178.16.52.139]:64114: 535 Incorrect authentication data (set_id=leong@ktlog.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:chriss.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cf9460c3591898e3af9d3c239196d0a60290183c||Title:0x0cea1ff0||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-02-02 00:16:24 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:43755: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.142.193.146
country_id: 798549
description:
2026-02-02 00:16:30 dovecot_plain authenticator failed for H=(gmail.com) [45.142.193.146]:8451: 535 Incorrect authentication data (set_id=info@cabe.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 00:16:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account leong@ktlog.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.108
country_id: 1814991
description:
2026-02-02 00:17:18 dovecot_login authenticator failed for H=([111.61.97.108]) [111.61.97.108]:12884: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:17:43 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51676: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.60.211.114
country_id: 6252001
description:
2026-02-02 00:17:58 dovecot_login authenticator failed for H=67-60-211-114.cpe.sparklight.net [67.60.211.114]:48360: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 00:17:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account leong@ktlog.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:17:05 dovecot_login authenticator failed for H=(5ju4kx4MdK) [178.16.52.139]:57912: 535 Incorrect authentication data (set_id=leong@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:17:09 dovecot_login authenticator failed for H=(3qOqFk3Oq) [158.94.208.175]:52997: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-02-02 00:17:21 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:57112: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-02-02 00:17:45 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:17740: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 00:17:50 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:48496: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:17:08 dovecot_login authenticator failed for H=(o5HLIYENI0) [178.16.54.22]:50276: 535 Incorrect authentication data (set_id=alexchan@fimco.com.my)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 136.228.132.70
country_id: 1831722
domain: nobledec.com
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:-2622'union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15-- ||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 136.228.132.70
country_id: 1831722
domain: nobledec.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:-2622'UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15-- ||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:chriss.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:93844630d3281020f058cf6e230fd82c1a21447b||Title:0xd1198e27||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lockch.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3bc00a3bf1020d90fa24a1e19a98a540b3043a3e||Title:0xfec3bd37||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 00:18:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account leong@ktlog.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0028197def5008f777974b79fb4b871a9647a557||Title:0xab60af64||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-02-02 00:18:08 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:53252: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2026-02-02 00:18:44 dovecot_plain authenticator failed for H=c-71-230-228-16.hsd1.de.comcast.net (vadgent) [71.230.228.16]:49990: 535 Incorrect authentication data (set_id=kendek@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:18:16 dovecot_login authenticator failed for H=(wr2ljWJkH) [178.16.52.139]:62377: 535 Incorrect authentication data (set_id=leong@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:18:20 dovecot_login authenticator failed for H=(TPOL74vGt) [158.94.208.175]:62302: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 00:18:42 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:18:45 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63310: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:18:01 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51676: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.142.193.146
country_id: 798549
description:
2026-02-02 00:18:10 dovecot_plain authenticator failed for H=(gmail.com) [45.142.193.146]:6767: 535 Incorrect authentication data (set_id=info@aoto.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:18:13 dovecot_login authenticator failed for H=(A5BwvT3f) [178.16.54.22]:49845: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-02-02 00:18:51 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:40218: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.55.80.146
country_id: 2510769
description:
2026-02-02 00:19:42 dovecot_login authenticator failed for H=146.red-83-55-80.dynamicip.rima-tde.net ([127.0.0.1]) [83.55.80.146]:46526: 535 Incorrect authentication data (set_id=meemee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:19:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63310: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:19:15 dovecot_login authenticator failed for H=(X1l5hzn) [178.16.54.22]:64216: 535 Incorrect authentication data (set_id=cklee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.65.177.118
country_id: 1814991
description:
2026-02-02 00:19:29 dovecot_login authenticator failed for H=([127.0.0.1]) [49.65.177.118]:36822: 535 Incorrect authentication data (set_id=kumara.rao)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:19:02 dovecot_login authenticator failed for H=(jMjJmS) [178.16.52.139]:58327: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2026-02-02 00:19:18 dovecot_login authenticator failed for H=([222.120.176.6]) [222.120.176.6]:34742: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lockch.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0cbbdd4db353c9b96e1fd87843850dc00841f586||Title:0x0de9f9ab||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.37.199.188
country_id: 2017370
description:
2026-02-02 00:19:35 dovecot_login authenticator failed for H=([127.0.0.1]) [92.37.199.188]:34809: 535 Incorrect authentication data (set_id=meemee@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:19:08 dovecot_login authenticator failed for H=(SxQSYPz) [158.94.208.175]:53175: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.225.86.64
country_id: 1814991
description:
2026-02-02 00:19:31 dovecot_login authenticator failed for H=([127.0.0.1]) [121.225.86.64]:58137: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.162.159.96
country_id: 1814991
description:
2026-02-02 00:19:19 dovecot_login authenticator failed for H=([127.0.0.1]) [124.162.159.96]:51118: 535 Incorrect authentication data (set_id=kumara.rao@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 00:19:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.142.193.146
country_id: 798549
description:
2026-02-02 00:19:15 dovecot_plain authenticator failed for H=(gmail.com) [45.142.193.146]:17269: 535 Incorrect authentication data (set_id=info@egbwawasan.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:20:04 dovecot_login authenticator failed for H=(3ErzFs) [178.16.54.22]:63534: 535 Incorrect authentication data (set_id=cklee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-02-02 00:20:05 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:37154: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ce3131a2771daf905ce9109f34a45c26a80efc6b||Title:0x69af904d||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 00:20:05 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53748: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 00:20:18 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (ovilry) [87.103.126.54]:43151: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.142.193.146
country_id: 798549
description:
2026-02-02 00:20:19 dovecot_plain authenticator failed for H=(gmail.com) [45.142.193.146]:58336: 535 Incorrect authentication data (set_id=info@inter-link.edu.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lockch.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9ea0715d1729f262e69f97200ff4c655fa88c8c1||Title:0x1e15572c||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:20:07 dovecot_login authenticator failed for H=(NTuu0E) [178.16.52.139]:56701: 535 Incorrect authentication data (set_id=mkmadmin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:20:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63618: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 00:20:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:20:18 dovecot_login authenticator failed for H=(v8H3JQ) [158.94.208.175]:51377: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-02-02 00:20:36 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:26360: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lockch.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:975a4844b7fb9bb8c9e75f39d6775bb5fffcc1cf||Title:0x7413623d||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.2.97.218
country_id: 1694008
domain: chs.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:39348.chs.com.my||ServerName:chs.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:945278da8e1e838b2f643fb002a6a46551aac145||Title:0x30f451ff||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.246
country_id: 1814991
description:
2026-02-02 00:21:43 dovecot_login authenticator failed for H=([116.114.84.246]) [116.114.84.246]:59208: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:21:02 dovecot_login authenticator failed for H=(ZVluLVF8iI) [178.16.54.22]:63831: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:21:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57576: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.142.193.146
country_id: 798549
description:
2026-02-02 00:21:09 dovecot_plain authenticator failed for H=(gmail.com) [45.142.193.146]:21749: 535 Incorrect authentication data (set_id=info@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:21:09 dovecot_login authenticator failed for H=(5VOvdi) [178.16.52.139]:61599: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2026-02-02 00:21:20 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:35562: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 00:21:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:21:04 dovecot_login authenticator failed for H=(4YgYQgJgU) [158.94.208.175]:61355: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:21:12 dovecot_login authenticator failed for H=(KrYM92) [178.16.54.22]:62070: 535 Incorrect authentication data (set_id=alexchan@fimco.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e8577c8927b6b6f49435a94b2f0e56be589d7490||Title:0x09168b04||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lockch.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f9b5cf623f20822060734a7f2cb7dfa448d5e580||Title:0x8ef27818||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:22:16 dovecot_login authenticator failed for H=(BgcQNrrLx) [158.94.208.175]:49746: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:22:17 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58500: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 00:22:18 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:37644: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:22:11 dovecot_login authenticator failed for H=(7M2IiM) [178.16.54.22]:51429: 535 Incorrect authentication data (set_id=cklee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:22:13 dovecot_login authenticator failed for H=(xvAuCQ1oN) [178.16.52.139]:62589: 535 Incorrect authentication data (set_id=leong@ktlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 00:22:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-02-02 00:22:36 dovecot_plain authenticator failed for H=(costh) [12.150.243.22]:17679: 535 Incorrect authentication data (set_id=mhisham.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-02-02 00:23:43 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:54521: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:23:57 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64418: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:23:04 dovecot_login authenticator failed for H=(pFLO2Mvik) [158.94.208.175]:54802: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:23:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53965: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lockch.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7caffe08a740006437ee7da54f205ee95e344976||Title:0x99a8ca4b||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 176.37.78.37
country_id: 690791
domain: pftfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/epft/upload/index.php||SC:/home/pftfood/public_html/epft/upload/index.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 00:23:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:23:16 dovecot_login authenticator failed for H=(J4pxCEf8Pd) [178.16.54.22]:62524: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b7d214a3c0fb7216d3461f7ea05244022de83cb6||Title:0x91bc748c||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:23:10 dovecot_login authenticator failed for H=(41vARLC0) [178.16.52.139]:55965: 535 Incorrect authentication data (set_id=leong@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:24:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51156: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 00:24:31 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49198: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.142.193.146
country_id: 798549
description:
2026-02-02 00:24:09 dovecot_plain authenticator failed for H=(gmail.com) [45.142.193.146]:24929: 535 Incorrect authentication data (set_id=info@ajresorts.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:24:16 dovecot_login authenticator failed for H=(i910723) [158.94.208.175]:63444: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b650c949071d0321b892d455ceacbcd5fda7c8d2||Title:0x11c4e0cb||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:24:23 dovecot_login authenticator failed for H=(aLSq1v) [178.16.54.22]:49179: 535 Incorrect authentication data (set_id=cklee)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 23.132.164.130
country_id: 2635167
description:
2026-02-02 00:24:04 H=([23.132.164.130]) [23.132.164.130]:54970 F=<yly@mail.hzau.edu.cn> rejected RCPT <info@inter-link.edu.my>: SPF: 23.132.164.130 is not allowed to send mail from mail.hzau.edu.cn


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lockch.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b06167b4eb30ad65a9c60c3cd8e8580f993298c1||Title:0x5c58475d||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:24:25 dovecot_login authenticator failed for H=(Q31dTJi) [178.16.52.139]:56969: 535 Incorrect authentication data (set_id=leong@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2026-02-02 00:25:33 dovecot_login authenticator failed for H=([222.120.176.6]) [222.120.176.6]:56420: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-02-02 00:25:52 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:53087: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:25:15 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59578: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:25:20 dovecot_login authenticator failed for H=(kXUo3rn) [178.16.52.139]:56450: 535 Incorrect authentication data (set_id=leong@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:25:03 dovecot_login authenticator failed for H=(XmDQOk) [158.94.208.175]:63842: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lockch.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0a3a0f5448a4373426f7c418b1ed6746552634c5||Title:0xe76ad07b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:25:21 dovecot_login authenticator failed for H=(nyJSJSyEFB) [178.16.54.22]:58609: 535 Incorrect authentication data (set_id=cklee)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7fce8053ae2cdc1cf67d5fe01fa518e197638d6f||Title:0x17f879b8||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-02-02 00:26:19 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:50324: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 00:26:43 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:34462: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:907999cc3f94f9fe8065b45f1ff03bf797b51cdb||Title:0x75886ff1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:26:02 dovecot_login authenticator failed for H=(4V8IlP) [178.16.54.22]:59450: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.242.3.116
country_id: 2750405
description:
2026-02-02  0:26:24 248360 [Warning] Aborted connection 248360 to db: 'unconnected' user: 'unauthenticated' host: '185.242.3.116' (This connection closed normally without authentication)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lockch.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:847891f3a96bd2ddf68afdf30d794343be344bda||Title:0xe1b4c2bf||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:26:13 dovecot_login authenticator failed for H=(SJMR2fFIL) [158.94.208.175]:64697: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-02 00:26:06 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:49489: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 00:26:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account leong@ktlog.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:26:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55796: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:26:11 dovecot_login authenticator failed for H=(zehETtuu) [178.16.52.139]:54075: 535 Incorrect authentication data (set_id=leong@ktlog.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:26:48 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51270: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:27:09 dovecot_login authenticator failed for H=(PiIL0a) [178.16.54.22]:64620: 535 Incorrect authentication data (set_id=cklee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:27:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58437: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lockch.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e25f99cef1e26b0577b5c534776475a3d6891aaa||Title:0xaa0bcddf||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:27:24 dovecot_login authenticator failed for H=(Rdmc1F) [158.94.208.175]:55452: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:27:25 dovecot_login authenticator failed for H=(WRXZ9VEt) [178.16.52.139]:51635: 535 Incorrect authentication data (set_id=leong@ktlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 00:27:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 00:27:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account leong@ktlog.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.38.136.211
country_id: 1814991
description:
2026-02-02 00:27:58 dovecot_login authenticator failed for H=([111.38.136.211]) [111.38.136.211]:59045: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 00:28:56 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36568: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 52.169.148.186
country_id: 2963597
domain: fkr.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/fkrcom/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 00:28:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:28:11 dovecot_login authenticator failed for H=(UNGJHft7j) [158.94.208.175]:50264: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.37.223.58
country_id: 3175395
description:
2026-02-02 00:28:28 dovecot_login authenticator failed for H=net-2-37-223-58.cust.vodafonedsl.it [2.37.223.58]:59208: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:28:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51587: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 00:28:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account leong@ktlog.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.159.71.249
country_id: 1835841
description:
2026-02-02 00:29:01 dovecot_login authenticator failed for H=([121.159.71.249]) [121.159.71.249]:58940: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.169.148.186
country_id: 2963597
domain: fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home2/fkrcom/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:28:03 dovecot_login authenticator failed for H=(w0mTeIDH) [178.16.54.22]:63059: 535 Incorrect authentication data (set_id=cklee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:28:21 dovecot_login authenticator failed for H=(7GcuDV) [178.16.52.139]:51311: 535 Incorrect authentication data (set_id=leong@ktlog.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lockch.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6ec5328e8ceb5238a98107f42b0cad7beff517c4||Title:0xbc001b80||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-02-02 00:28:50 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:53078: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1ff9f8f1c1a7e710f1509fc6afdfa0941a88fb9b||Title:0x01a871ee||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:29:21 dovecot_login authenticator failed for H=(FbhAwO75n) [178.16.54.22]:55441: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9289b6cd710c2bcd7322510e685090011e7b2227||Title:0x96206fe2||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lockch.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:77c41bcf22c5e67f7fb10527b3de460656cc8b23||Title:0xfea5c751||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 00:29:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:29:21 dovecot_login authenticator failed for H=(HeB01x) [158.94.208.175]:52507: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:29:34 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55357: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.205.115.105
country_id: 1819730
domain: mail.agsaintifik.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home2/agsaintifik/public_html/wp-admin/images/admin.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 00:29:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account leong@ktlog.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-02-02 00:29:15 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:58214: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:29:15 dovecot_login authenticator failed for H=(zNuu1Hrzf0) [178.16.52.139]:50687: 535 Incorrect authentication data (set_id=leong@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:29:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51224: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.205.115.105
country_id: 1819730
domain: agsaintifik.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/agsaintifik/public_html/wp-includes/SimplePie/wp-login.php||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 00:30:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account leong@ktlog.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:30:09 dovecot_login authenticator failed for H=(2aZteUWw) [158.94.208.175]:51637: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:30:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61977: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4971eac5863fd46bebd8bfca47a86b73d8011138||Title:0xee67fd82||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:30:03 dovecot_login authenticator failed for H=(W0ketn1FK) [178.16.54.22]:49252: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 00:30:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.242.3.116
country_id: 2750405
description:
2026-02-02  0:30:29 248575 [Warning] Aborted connection 248575 to db: 'unconnected' user: 'unauthenticated' host: '185.242.3.116' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:30:05 dovecot_login authenticator failed for H=(IAVYZwZ9w) [178.16.52.139]:64560: 535 Incorrect authentication data (set_id=leong@ktlog.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lockch.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:30f6b95a2d1dadd931026c2437583923c86e40dd||Title:0xd39ca5f0||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 176.65.149.169
country_id: 2750405
domain: mckd.com.my
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:7.71||T:APACHE||MV:/assets/images/accesson.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 00:31:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:31:22 dovecot_login authenticator failed for H=(1DGKLfl0fh) [178.16.52.139]:52579: 535 Incorrect authentication data (set_id=leong@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:31:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56886: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-02-02 00:31:42 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:57248: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 00:31:07 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38872: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:31:19 dovecot_login authenticator failed for H=(4PgTrnh7xB) [158.94.208.175]:62034: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lockch.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:38de01fe2273e03b9074dfa16a5376fbb23aaea5||Title:0xe3c45ce1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.203.28
country_id: 1831722
description:
2026-02-02 00:31:30 dovecot_login authenticator failed for H=([36.37.203.28]) [36.37.203.28]:33430: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:31:20 dovecot_login authenticator failed for H=(XxKA3WKbaZ) [178.16.54.22]:51210: 535 Incorrect authentication data (set_id=cklee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.94.220.9
country_id: 1814991
description:
2026-02-02 00:32:46 dovecot_login authenticator failed for H=([183.94.220.9]) [183.94.220.9]:54554: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.106
country_id: 1269750
description:
2026-02-02 00:32:19 dovecot_login authenticator failed for H=([182.95.20.55]) [182.95.228.106]:37278: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2026-02-02 00:32:30 dovecot_login authenticator failed for H=([152.52.234.170]) [182.95.177.78]:45180: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:32:45 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63814: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:32:07 dovecot_login authenticator failed for H=(oIoGzeAnH) [158.94.208.175]:61275: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:32:32 dovecot_login authenticator failed for H=(b91bTMn3) [178.16.54.22]:55912: 535 Incorrect authentication data (set_id=cklee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:32:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54505: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.130
country_id: 1269750
description:
2026-02-02 00:32:55 dovecot_login authenticator failed for H=([182.95.58.130]) [182.95.58.130]:55742: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lockch.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fdf201383611669f24856504dd6ea02dcfa11828||Title:0xc64ac9bd||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.91.126.112
country_id: 1814991
description:
2026-02-02 00:32:29 dovecot_login authenticator failed for H=([101.91.126.112]) [101.91.126.112]:52684: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:32:08 dovecot_login authenticator failed for H=(HO8CLu4G) [178.16.52.139]:61797: 535 Incorrect authentication data (set_id=leong@ktlog.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4819757b8931c322452e6e956b285ab9a1f6ff02||Title:0xd379563c||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 4.217.180.34
country_id: 1835841
domain: cloud.imax.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/var/www/html/wp-includes||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lockch.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:acf11fbb143d55104e04fed5491e0e7f355ceecb||Title:0xb602b9bb||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:33:18 dovecot_login authenticator failed for H=(yCA8WhiDK) [158.94.208.175]:61370: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:33:29 dovecot_login authenticator failed for H=(Em3Y0Uxw) [178.16.52.139]:59344: 535 Incorrect authentication data (set_id=leong@ktlog.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.217.180.34
country_id: 1835841
domain: cloud.imax.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/admin.php||SC:/var/www/html/wp-admin||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2b0ce6a5a9e992c630b927f89830eb59103eaf91||Title:0x249d0fed||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.208.84
country_id: 1210997
description:
2026-02-02 00:33:15 dovecot_plain authenticator failed for H=(E43HFC1) [104.28.208.84]:48546: 535 Incorrect authentication data (set_id=dsc_team.info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 00:33:19 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55042: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
country_id: 1814991
description:
2026-02-02 00:33:49 dovecot_login authenticator failed for H=([112.194.142.167]) [112.194.142.167]:36168: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:33:12 dovecot_login authenticator failed for H=(RNbU54) [178.16.54.22]:60414: 535 Incorrect authentication data (set_id=ramin.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:33:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63814: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:34:05 dovecot_login authenticator failed for H=(mre1w3fv) [158.94.208.175]:53982: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-02-02 00:34:37 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:60207: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.159.71.249
country_id: 1835841
description:
2026-02-02 00:34:50 dovecot_login authenticator failed for H=([121.159.71.249]) [121.159.71.249]:51470: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:34:44 dovecot_login authenticator failed for H=(uIHKxyNzD) [178.16.52.139]:58725: 535 Incorrect authentication data (set_id=leong@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.162
country_id: 1269750
description:
2026-02-02 00:34:46 dovecot_login authenticator failed for H=(nsg-corporate-162.230.187.122.airtel.in) [122.187.230.162]:57955: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b0cb1077107e7f152f28e3354ff817212424b291||Title:0x1bbbbfc7||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lockch.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:78f0f520675ef7b6a42bbfb20dd7282700c22455||Title:0x9830f16f||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:34:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58468: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:34:25 dovecot_login authenticator failed for H=(HigqvA) [178.16.54.22]:52428: 535 Incorrect authentication data (set_id=cklee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:35:17 dovecot_login authenticator failed for H=(K2Zhvu6zJ) [158.94.208.175]:55430: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:35:20 dovecot_login authenticator failed for H=(KDpsPtF) [178.16.54.22]:55019: 535 Incorrect authentication data (set_id=ramin.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.231.250.3
country_id: 6252001
description:
2026-02-02 00:35:22 dovecot_login authenticator failed for H=([127.0.0.1]) [199.231.250.3]:37198: 535 Incorrect authentication data (set_id=corporate@mssa.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 00:35:32 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:40272: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-02 00:35:33 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:44180: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 00:35:35 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account leong@ktlog.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.60.211.114
country_id: 6252001
description:
2026-02-02 00:35:44 dovecot_login authenticator failed for H=67-60-211-114.cpe.sparklight.net [67.60.211.114]:49294: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:35:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61304: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:35:11 dovecot_login authenticator failed for H=(fd7BCxc4X) [178.16.52.139]:55678: 535 Incorrect authentication data (set_id=leong@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.34
country_id: 1269750
description:
2026-02-02 00:35:14 dovecot_login authenticator failed for H=(nsg-corporate-78.223.187.122.airtel.in) [182.66.214.34]:58582: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:35:36 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49900: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:00852d0bf542ed3abe459d2cc0dac521274cfdfc||Title:0x40b8cd6d||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lockch.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cd62a099f2e67883d5c1d61ca9b3cc86ef228ff8||Title:0x9f3d8455||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.219.214.130
country_id: 1814991
description:
2026-02-02 00:35:32 dovecot_login authenticator failed for H=([127.0.0.1]) [221.219.214.130]:60696: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 00:36:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:36:06 dovecot_login authenticator failed for H=(80xD9jxE) [178.16.54.22]:57635: 535 Incorrect authentication data (set_id=ramin.fpp)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lockch.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:378bbbf428676b68c24bd2c2e18c63ad3e6124fb||Title:0xd2f77b77||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 00:36:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account leong@ktlog.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ccbbca8bda1017690be2ebae6e8aa20cf759ce7c||Title:0xadddd8f6||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:36:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54750: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.30.85.20
country_id: 1168579
description:
2026-02-02 00:36:32 dovecot_plain authenticator failed for H=static-host119-30-85-20.link.net.pk (1VT5KO7) [119.30.85.20]:21697: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:36:04 dovecot_login authenticator failed for H=(uIklNi) [158.94.208.175]:57444: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:36:08 dovecot_login authenticator failed for H=(hD9M8O9g) [178.16.52.139]:60730: 535 Incorrect authentication data (set_id=leong@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 00:37:43 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:60520: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 00:37:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.157.221.233
country_id: 953987
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=571193 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:37:23 dovecot_login authenticator failed for H=(GSjCCqRh) [178.16.52.139]:50558: 535 Incorrect authentication data (set_id=leong@ktlog.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0b823bf87bb983849e21af89c2542c26ed7a8f53||Title:0x2bd2d486||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:37:13 dovecot_login authenticator failed for H=(mGTpbc) [158.94.208.175]:51313: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:37:19 dovecot_login authenticator failed for H=(WW0Ls2cI) [178.16.54.22]:57558: 535 Incorrect authentication data (set_id=cklee@ktlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 00:37:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account leong@ktlog.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:37:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50444: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2026-02-02 00:37:32 dovecot_plain authenticator failed for H=c-24-15-216-41.hsd1.il.comcast.net (froncoves) [24.15.216.41]:38094: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.146.45
country_id: 1269750
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lockch.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5db692857458b63df6fab26f83f6d4da9c117e62||Title:0xbf58ce20||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:38:01 dovecot_login authenticator failed for H=(UDkBrE8J) [158.94.208.175]:62489: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:38:17 dovecot_login authenticator failed for H=(TqepnRDrw8) [178.16.52.139]:53214: 535 Incorrect authentication data (set_id=leong@ktlog.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:38:39 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55150: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:38:06 dovecot_login authenticator failed for H=(ip0dJ0wVkP) [178.16.54.22]:60514: 535 Incorrect authentication data (set_id=ramin.fpp)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 00:38:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account leong@ktlog.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 161.142.118.113
country_id: 1733045
description:
[2026-02-02 00:38:46 +0800] info [webmaild] 161.142.118.113 - s-osada@mckd.com.my "GET /cpsess0355421917/3rdparty/roundcube/skins/elastic/watermark.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5389d8deced29b6eca520fdd66b3add69e21d90c||Title:0xb560aa99||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:38:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55150: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 00:38:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:39:32 dovecot_login authenticator failed for H=(2jrR9q9rwz) [178.16.52.139]:52136: 535 Incorrect authentication data (set_id=leong@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2026-02-02 00:39:53 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:52855: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:39:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65218: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.113
country_id: 1814991
description:
2026-02-02 00:39:17 dovecot_login authenticator failed for H=(113.20.167.124.adsl-pool.sx.cn) [124.167.20.113]:60847: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 00:39:30 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account leong@ktlog.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fd869782d4e656b3919f85d401f4085864ba7ea7||Title:0x58e460d3||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.205.115.105
country_id: 1819730
domain: mail.astlog.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/astlogc/public_html/wp-includes/SimplePie/wp-login.php||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:39:04 dovecot_login authenticator failed for H=(lSoA2ae6) [178.16.54.22]:53743: 535 Incorrect authentication data (set_id=cklee@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:39:12 dovecot_login authenticator failed for H=(LkfDTQ) [158.94.208.175]:55582: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 00:39:57 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50980: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 00:39:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.205.115.105
country_id: 1819730
domain: mail.astlog.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/astlogc/public_html/wp-admin/images/admin.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:40:14 dovecot_login authenticator failed for H=(cS7sUZvyTR) [178.16.54.22]:58680: 535 Incorrect authentication data (set_id=cklee@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-02-02 00:40:25 dovecot_plain authenticator failed for H=(huromelul) [12.150.243.22]:31136: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/news.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:40:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58708: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.106
country_id: 6252001
description:
2026-02-02  0:40:22 249061 [Warning] Aborted connection 249061 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.106' (This connection closed normally without authentication)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:65d1afb89c80b30a3b0b0193184cd0afec87215b||Title:0xfb9c5bb9||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 00:40:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:40:22 dovecot_login authenticator failed for H=(LGytyecx) [158.94.208.175]:61267: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:40:25 dovecot_login authenticator failed for H=(FxT3g7DH8) [178.16.52.139]:61454: 535 Incorrect authentication data (set_id=leong@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.245.22.2
country_id: 1562822
description:
2026-02-02 00:41:42 dovecot_plain authenticator failed for H=(JKJEX) [171.245.22.2]:49318: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c20f694fc805b81f546cc3403325c29ae3c98671||Title:0x4cafe73e||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.140
country_id: 1835841
description:
2026-02-02 00:41:58 dovecot_login authenticator failed for H=([120.29.140.140]) [120.29.140.140]:43656: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:41:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57292: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:41:25 dovecot_login authenticator failed for H=(tcAYateH5) [178.16.54.22]:56945: 535 Incorrect authentication data (set_id=ramin.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2026-02-02 00:41:47 dovecot_login authenticator failed for H=24-119-144-86.cpe.sparklight.net [24.119.144.86]:57772: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:41:08 dovecot_login authenticator failed for H=(ASdgAoHVk) [158.94.208.175]:51964: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:41:11 dovecot_login authenticator failed for H=(rtJFupg) [178.16.52.139]:56336: 535 Incorrect authentication data (set_id=leong@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:42:03 dovecot_login authenticator failed for H=(sGEXa7Y) [178.16.52.139]:60380: 535 Incorrect authentication data (set_id=leong@ktlog.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/index.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ca2ef5739170b5c810cd9c9e3840b8cfcbbd2dce||Title:0x5df2417e||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:42:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52580: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 00:42:07 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39370: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:42:18 dovecot_login authenticator failed for H=(WsA60uNfgn) [158.94.208.175]:63725: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:42:32 dovecot_login authenticator failed for H=(4tYfoq) [178.16.54.22]:64065: 535 Incorrect authentication data (set_id=ramin.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:43:04 dovecot_login authenticator failed for H=(9fudEDhL) [158.94.208.175]:58687: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:762aeb2e40f054fc613b051aa579aa360cd06716||Title:0x9ccc5be5||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:43:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52323: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:43:20 dovecot_login authenticator failed for H=(YGixRkZ24) [178.16.52.139]:61864: 535 Incorrect authentication data (set_id=leong@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:43:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65163: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:43:11 dovecot_login authenticator failed for H=(Do147J4Ji) [178.16.54.22]:56032: 535 Incorrect authentication data (set_id=cklee@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:44:17 dovecot_login authenticator failed for H=(SAgd4h5O) [178.16.54.22]:51263: 535 Incorrect authentication data (set_id=cklee@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 00:44:21 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56190: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:44:13 dovecot_login authenticator failed for H=(MoV9OFS5) [158.94.208.175]:53320: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:44:15 dovecot_login authenticator failed for H=(3uaCO30rz) [178.16.52.139]:64460: 535 Incorrect authentication data (set_id=leong@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.51.244
country_id: 6252001
description:
2026-02-02 00:44:15 dovecot_login authenticator failed for H=dummitfradin.com [174.138.51.244]:57706: 535 Incorrect authentication data (set_id=project@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.123.219.82
country_id: 6252001
description:
2026-02-02 00:44:18 dovecot_plain authenticator failed for H=ool-457bdb52.dyn.optonline.net (seugh) [69.123.219.82]:40448: 535 Incorrect authentication data (set_id=seanlee@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-02-02 00:44:59 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:57042: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:44:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63641: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 00:44:34 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9c7d71c37027414176752aa0bc4576f9bc14de4a||Title:0x24b6fff3||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:45:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56983: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.205.169
country_id: 1733045
description:
2026-02-02 00:45:38 dovecot_login authenticator failed for H=([49.124.205.169]) [49.124.205.169]:50188: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-02-02 00:45:29 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:63836: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.136.148.116
country_id: 99237
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/teachers/images/banner2.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 00:45:55 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account leong@ktlog.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2026-02-02 00:45:35 dovecot_login authenticator failed for H=([91.73.195.150]) [91.73.195.150]:55456: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ahfengineering.com.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:661a788403f8ea4154288079e61b5d48a088a241||Title:0xd5100281||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.73.174
country_id: 1814991
description:
2026-02-02 00:45:49 dovecot_login authenticator failed for H=([60.8.73.174]) [60.8.73.174]:11302: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:45:05 dovecot_login authenticator failed for H=(mKGNo0VAX) [178.16.54.22]:54869: 535 Incorrect authentication data (set_id=ramin.fpp)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 00:45:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 00:45:30 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (supitow) [87.103.126.54]:35224: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.37.135.182
country_id: 357994
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/teachers/images/logo.png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 62.73.115.86
country_id: 732800
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/wp/depts/images/logo.png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:45:16 dovecot_login authenticator failed for H=(54bXtmU8m) [178.16.52.139]:59624: 535 Incorrect authentication data (set_id=leong@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.192.93.109
country_id: 3175395
description:
2026-02-02 00:45:59 dovecot_login authenticator failed for H=([127.0.0.1]) [2.192.93.109]:44782: 535 Incorrect authentication data (set_id=info@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:45:23 dovecot_login authenticator failed for H=(9lnZLDSP10) [158.94.208.175]:53671: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.209.222.188
country_id: 2287781
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/teachers/images/logo-(3).png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:46:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53228: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:46:21 dovecot_login authenticator failed for H=(kluiHejT) [178.16.54.22]:62024: 535 Incorrect authentication data (set_id=cklee@ktlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 00:46:37 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account leong@ktlog.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.211.145.47
country_id: 192950
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/wp/depts/images/banner3.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-02-02 00:46:49 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:44510: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.157.218.74
country_id: 174982
description:
2026-02-02 00:46:07 dovecot_login authenticator failed for H=([127.0.0.1]) [37.157.218.74]:53930: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 00:46:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:46:11 dovecot_login authenticator failed for H=(P4y3DfOTT) [158.94.208.175]:61873: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.222
country_id: 1819730
description:
2026-02-02 00:46:38 dovecot_login authenticator failed for H=222.42.246.220.static.netvigator.com [220.246.42.222]:56797: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ahfengineering.com.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:81be1fa3cab6280e5864482aca686d42b3d8e73f||Title:0x5853fb0e||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.153.66.163
country_id: 617790
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/teachers/images/banner3.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 177.125.223.117
country_id: 3469034
domain: cofreth.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:21850.cofreth.com.my||ServerName:cofreth.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cc023699bdeca0e0db187a434aa94b192b209fb4||Title:0xab82203e||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:46:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59420: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 00:46:34 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56906: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.233.73.136
country_id: 1269750
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/teachers/images/banner1.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.89.120.13
country_id: 1210997
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/wp/depts/images/banner4.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.47.139.112
country_id: 587116
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/wp/depts/images/banner2.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-02-02 00:46:56 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:8470: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:46:23 dovecot_login authenticator failed for H=(QJEz3xt) [178.16.52.139]:61407: 535 Incorrect authentication data (set_id=admin@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.228.237.90
country_id: 1814991
description:
2026-02-02 00:47:47 dovecot_login authenticator failed for H=([221.228.237.90]) [221.228.237.90]:48258: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.236
country_id: 2635167
description:
2026-02-02 00:47:47 dovecot_login authenticator failed for H=(5qCwVd) [185.169.4.236]:51580: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 43.246.202.131
country_id: 1210997
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/wp/depts/images/banner1.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:47:07 dovecot_login authenticator failed for H=(03PM9rUl) [178.16.52.139]:61949: 535 Incorrect authentication data (set_id=leong@ktlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 00:47:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ahfengineering.com.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:68f1c528ea15396d348049dd291de628377c1921||Title:0x48975fe2||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:47:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52837: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 206.168.34.118
country_id: 6252001
description:
2026-02-02  0:47:46 249511 [Warning] Aborted connection 249511 to db: 'unconnected' user: 'unauthenticated' host: '206.168.34.118' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-02-02 00:47:52 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:47708: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 00:47:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account leong@ktlog.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:47:21 dovecot_login authenticator failed for H=(6dGD4w) [158.94.208.175]:62333: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.181.216.158
country_id: 660013
description:
2026-02-02 00:47:58 dovecot_login authenticator failed for H=mail.paul42.de ([127.0.0.1]) [135.181.216.158]:55260: 535 Incorrect authentication data (set_id=no-reply@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.36.170.39
country_id: 1814991
description:
2026-02-02 00:48:00 dovecot_login authenticator failed for H=([127.0.0.1]) [153.36.170.39]:57594: 535 Incorrect authentication data (set_id=arts@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:47:05 dovecot_login authenticator failed for H=(3paUUle6N) [178.16.54.22]:63874: 535 Incorrect authentication data (set_id=ramin.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 00:48:45 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36780: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 00:48:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.162.159.96
country_id: 1814991
description:
2026-02-02 00:48:07 dovecot_login authenticator failed for H=([127.0.0.1]) [124.162.159.96]:38421: 535 Incorrect authentication data (set_id=no-reply)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.29.170
country_id: 1814991
description:
2026-02-02 00:48:09 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.29.170]:48977: 535 Incorrect authentication data (set_id=arts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:48:38 dovecot_login authenticator failed for H=(0X2kqmXv) [178.16.52.139]:60993: 535 Incorrect authentication data (set_id=admin@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:48:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60231: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.236
country_id: 2635167
description:
2026-02-02 00:48:07 dovecot_login authenticator failed for H=(jiaxC3X0f) [185.169.4.236]:54275: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:48:09 dovecot_login authenticator failed for H=(zgpXabOri) [178.16.54.22]:53549: 535 Incorrect authentication data (set_id=ramin.fpp)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.186.78.157
country_id: 1269750
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/teachers/images/banner4.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 00:48:52 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account leong@ktlog.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:48:07 dovecot_login authenticator failed for H=(69R2N4UZH7) [158.94.208.175]:58997: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ahfengineering.com.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d4132f73ad1ed9a72b143551e92965e4eb76f268||Title:0x62453b5d||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:49:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57475: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:49:16 dovecot_login authenticator failed for H=(s1O8V66toP) [158.94.208.175]:58447: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:49:19 dovecot_login authenticator failed for H=(ozjtlf) [178.16.52.139]:54708: 535 Incorrect authentication data (set_id=leong@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.224.59.38
country_id: 1835841
description:
2026-02-02 00:49:49 dovecot_login authenticator failed for H=([211.224.59.38]) [211.224.59.38]:39958: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.236
country_id: 2635167
description:
2026-02-02 00:49:04 dovecot_login authenticator failed for H=(i5nEdbTpI) [185.169.4.236]:49930: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 00:49:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account leong@ktlog.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:49:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56027: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:49:18 dovecot_login authenticator failed for H=(z9PpvxMRU) [178.16.54.22]:64094: 535 Incorrect authentication data (set_id=ramin.fpp)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ahfengineering.com.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8f75d3448f3a811c46b74cf9231dcfe8451b871f||Title:0x1f0e3ae4||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.22.99.2
country_id: 1814991
description:
2026-02-02 00:49:34 dovecot_login authenticator failed for H=(hebei.22.121.in-addr.arpa) [121.22.99.2]:55282: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:50:33 dovecot_login authenticator failed for H=(bDTUN1) [178.16.54.22]:61795: 535 Incorrect authentication data (set_id=cklee@ktlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.236
country_id: 2635167
description:
Feb  2 00:50:37 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.169.4.236


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:50:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52580: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:50:18 dovecot_login authenticator failed for H=(F3mgUCzsZL) [178.16.52.139]:60304: 535 Incorrect authentication data (set_id=admin@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.236
country_id: 2635167
description:
2026-02-02 00:50:20 dovecot_login authenticator failed for H=(tjXaJKNl) [185.169.4.236]:50673: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ahfengineering.com.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1937e81ccfcf6e1d6d3b8e586b5d77376d3eb582||Title:0xf5d385f3||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 00:50:56 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50566: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:50:02 dovecot_login authenticator failed for H=(ZQwfsWH) [158.94.208.175]:63353: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:51:08 dovecot_login authenticator failed for H=(iSitHgzu4H) [178.16.52.139]:57291: 535 Incorrect authentication data (set_id=admin@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:51:33 dovecot_login authenticator failed for H=(hZGgjp3J) [158.94.208.175]:52257: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:51:18 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53617: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ahfengineering.com.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fe442a784fb1abb85ea3ca68c2c3aa3172175af8||Title:0xc0afaace||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.169.4.236
country_id: 2635167
description:
2026-02-02 00:51:27 dovecot_login authenticator failed for H=(b00u42) [185.169.4.236]:49250: 535 Incorrect authentication data (set_id=celine@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.236
country_id: 2635167
description:
2026-02-02 00:51:08 dovecot_login authenticator failed for H=(ooDLXzsj) [185.169.4.236]:61724: 535 Incorrect authentication data (set_id=jacklim@ktlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.236
country_id: 2635167
description:
Feb  2 00:51:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.169.4.236


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:51:26 dovecot_login authenticator failed for H=(HClltoE) [178.16.54.22]:51879: 535 Incorrect authentication data (set_id=ramin.fpp@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.236
country_id: 2635167
description:
Feb  2 00:52:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.169.4.236


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-02-02 00:52:29 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:37808: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2026-02-02 00:52:44 dovecot_login authenticator failed for H=(187-40-215-162.user.veloxzone.com.br) [187.40.215.162]:42157: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.169.4.236
country_id: 2635167
description:
2026-02-02 00:52:52 dovecot_login authenticator failed for H=(7THDydkgoh) [185.169.4.236]:64328: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:52:03 dovecot_login authenticator failed for H=(N2fHQVL) [178.16.54.22]:56188: 535 Incorrect authentication data (set_id=cklee@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.236
country_id: 2635167
description:
2026-02-02 00:52:05 dovecot_login authenticator failed for H=(XKNM5qXHGn) [185.169.4.236]:55785: 535 Incorrect authentication data (set_id=celine@ktlog.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ahfengineering.com.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4369cbfe23f1886b3f4d38a28c1325860a1ab854||Title:0xd726e382||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:52:03 dovecot_login authenticator failed for H=(mPA0Mr) [178.16.52.139]:65137: 535 Incorrect authentication data (set_id=leong@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:52:19 dovecot_login authenticator failed for H=(8z994vg) [158.94.208.175]:59158: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:52:19 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49253: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-02-02 00:52:48 dovecot_plain authenticator failed for H=(bittionved) [154.144.243.93]:42044: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 185.169.4.236
country_id: 2635167
description:
Feb  2 00:53:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account jacklim@ktlog.com.my has been temporarily locked by Imunify PAM(185.169.4.236)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:53:05 dovecot_login authenticator failed for H=(MH3IgvMF2) [158.94.208.175]:49865: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 00:53:26 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.236
country_id: 2635167
description:
2026-02-02 00:53:02 dovecot_login authenticator failed for H=(yesH5x) [185.169.4.236]:50033: 535 Incorrect authentication data (set_id=celine@ktlog.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ahfengineering.com.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:758df9e10040f28b7d68f42d1400a219c72a6aaa||Title:0xa5e235df||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:53:15 dovecot_login authenticator failed for H=(sbXNUg) [178.16.54.22]:57676: 535 Incorrect authentication data (set_id=cklee@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2026-02-02 00:53:36 dovecot_plain authenticator failed for H=c-73-197-194-98.hsd1.nj.comcast.net (filder) [73.197.194.98]:44108: 535 Incorrect authentication data (set_id=jun@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 00:53:09 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:37900: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.236
country_id: 2635167
description:
Feb  2 00:53:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.169.4.236


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:53:12 dovecot_login authenticator failed for H=(LNMUElQ5) [178.16.52.139]:64074: 535 Incorrect authentication data (set_id=admin@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:53:15 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60199: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:54:15 dovecot_login authenticator failed for H=(VZNBUrTr6) [158.94.208.175]:64844: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 185.169.4.236
country_id: 2635167
description:
Feb  2 00:54:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account jacklim@ktlog.com.my has been temporarily locked by Imunify PAM(185.169.4.236)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:54:18 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55576: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.169.4.236
country_id: 2635167
description:
2026-02-02 00:54:18 dovecot_login authenticator failed for H=(0mdPuI) [185.169.4.236]:65155: 535 Incorrect authentication data (set_id=jacklim@ktlog.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ahfengineering.com.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:85f75f9fecf6ffd7ea3fe74a8d33991f52b56174||Title:0x06358512||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.236
country_id: 2635167
description:
2026-02-02 00:54:08 dovecot_login authenticator failed for H=(O1iPJpOqO) [185.169.4.236]:63469: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 00:54:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:54:46 dovecot_login authenticator failed for H=(gBdvZ9IM) [178.16.54.22]:49757: 535 Incorrect authentication data (set_id=ramin.fpp@vc-b.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 185.93.89.64
country_id: 130758
description:
Feb  2 00:54:56 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account jacklim@ktlog.com.my has been temporarily locked by Imunify PAM(185.93.89.64)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.236
country_id: 2635167
description:
Feb  2 00:54:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.169.4.236


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:54:09 dovecot_login authenticator failed for H=(7f6FsSi) [178.16.52.139]:60928: 535 Incorrect authentication data (set_id=leong@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:55:07 dovecot_login authenticator failed for H=(iR5yl85H) [178.16.54.22]:62714: 535 Incorrect authentication data (set_id=cklee@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 00:55:22 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44468: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.169.4.236
country_id: 2635167
description:
2026-02-02 00:55:53 dovecot_login authenticator failed for H=(6f0c57) [185.169.4.236]:50502: 535 Incorrect authentication data (set_id=celine@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.236
country_id: 2635167
description:
2026-02-02 00:55:05 dovecot_login authenticator failed for H=(qMufoJb) [185.169.4.236]:58071: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:55:14 dovecot_login authenticator failed for H=(iPLtYLsSl2) [178.16.52.139]:59101: 535 Incorrect authentication data (set_id=leong@ktlog.com.my)


plugin: modsec
rule: 77350296
name: IM360 WAF: Block access to the shell
abuser: 20.89.56.252
country_id: 1861060
domain: ocned.com
description:
IM360 WAF: Block access to the shell||MV:/wp-content/plugins/seoplugins/mar.php||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.236
country_id: 2635167
description:
Feb  2 00:55:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.169.4.236


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ahfengineering.com.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6a7bd287a363e4b567c1974707da540b4304b0f0||Title:0x9efcd0fe||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 00:55:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 185.169.4.236
country_id: 2635167
description:
Feb  2 00:55:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account jacklim@ktlog.com.my has been temporarily locked by Imunify PAM(185.169.4.236)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:55:25 dovecot_login authenticator failed for H=(adXwuqAY8) [158.94.208.175]:60729: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:55:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63712: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.236
country_id: 2635167
description:
2026-02-02 00:56:02 dovecot_login authenticator failed for H=(pI2HAImJ) [185.169.4.236]:51999: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.236
country_id: 2635167
description:
Feb  2 00:56:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine@ktlog.com.my has been locked for the attacker IP 185.169.4.236


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:56:10 dovecot_login authenticator failed for H=(2b59jk8V) [178.16.52.139]:56654: 535 Incorrect authentication data (set_id=leong@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.198.31
country_id: 1814991
description:
2026-02-02 00:56:21 dovecot_login authenticator failed for H=([183.167.198.31]) [183.167.198.31]:59894: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.61.48.234
country_id: 1835841
description:
2026-02-02 00:56:27 dovecot_login authenticator failed for H=([125.61.48.234]) [125.61.48.234]:60411: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 185.169.4.236
country_id: 2635167
description:
Feb  2 00:56:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account jacklim@ktlog.com.my has been temporarily locked by Imunify PAM(185.169.4.236)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:56:12 dovecot_login authenticator failed for H=(PnRlFkc) [158.94.208.175]:65078: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.92.202
country_id: 1269750
description:
2026-02-02 00:56:13 dovecot_login authenticator failed for H=([27.123.92.202]) [27.123.92.202]:55122: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ahfengineering.com.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6415306602ba446c57fbc1198a350808fbbda174||Title:0xff8f9952||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-02 00:56:10 dovecot_login authenticator failed for H=(l9kUQK) [178.16.54.22]:63478: 535 Incorrect authentication data (set_id=cklee@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-02-02 00:56:42 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:51360: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:56:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60464: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 00:56:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-02-02 00:56:48 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:39598: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ahfengineering.com.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3b61eeddeb99a78883d235a2146a511215b26be4||Title:0xcdb72110||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.169.4.236
country_id: 2635167
description:
2026-02-02 00:57:18 dovecot_login authenticator failed for H=(bSOSXuVXvm) [185.169.4.236]:49846: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:57:22 dovecot_login authenticator failed for H=(kI3kuk7acR) [158.94.208.175]:57006: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 00:57:34 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56270: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/introduction-service.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 185.169.4.236
country_id: 2635167
description:
Feb  2 00:57:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account jacklim@ktlog.com.my has been temporarily locked by Imunify PAM(185.169.4.236)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.236
country_id: 2635167
description:
Feb  2 00:57:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine@ktlog.com.my has been locked for the attacker IP 185.169.4.236


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.142.243
country_id: 1819730
description:
2026-02-02 00:57:04 dovecot_login authenticator failed for H=243.142.48.116.static.netvigator.com [116.48.142.243]:63502: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.60.211.114
country_id: 6252001
description:
2026-02-02 00:57:24 dovecot_login authenticator failed for H=67-60-211-114.cpe.sparklight.net [67.60.211.114]:60352: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:57:13 dovecot_login authenticator failed for H=(yp9Yp3) [178.16.52.139]:50026: 535 Incorrect authentication data (set_id=leong@ktlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 00:57:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:57:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64456: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.170
country_id: 1814991
description:
2026-02-02 00:57:43 dovecot_login authenticator failed for H=([116.114.84.170]) [116.114.84.170]:60784: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.236
country_id: 2635167
description:
2026-02-02 00:57:09 dovecot_login authenticator failed for H=(fsv6qFlD) [185.169.4.236]:64531: 535 Incorrect authentication data (set_id=celine@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.236
country_id: 2635167
description:
2026-02-02 00:58:06 dovecot_login authenticator failed for H=(hadexFr) [185.169.4.236]:59545: 535 Incorrect authentication data (set_id=celine@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.87
country_id: 1269750
description:
2026-02-02 00:58:37 dovecot_login authenticator failed for H=(nsg-corporate-87.229.187.122.airtel.in) [122.187.229.87]:39614: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 00:58:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account leong@ktlog.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2026-02-02 00:58:42 dovecot_login authenticator failed for H=([221.209.48.204]) [221.209.48.203]:46768: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:58:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56921: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ahfengineering.com.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:08cea6419c1ac0dd60d220955f22171bab136b7c||Title:0xce210929||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:58:05 dovecot_login authenticator failed for H=(gDxemNU) [178.16.52.139]:53776: 535 Incorrect authentication data (set_id=leong@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:58:09 dovecot_login authenticator failed for H=(DC3fy1bQ) [158.94.208.175]:57844: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 00:58:15 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:31485: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.169.4.236
country_id: 2635167
description:
2026-02-02 00:58:45 dovecot_login authenticator failed for H=(RRmzS03Pp) [185.169.4.236]:51256: 535 Incorrect authentication data (set_id=jacklim@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
country_id: 1835841
description:
2026-02-02 00:58:58 dovecot_login authenticator failed for H=([220.95.14.102]) [220.95.14.102]:55626: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.236
country_id: 2635167
description:
Feb  2 00:58:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine@ktlog.com.my has been locked for the attacker IP 185.169.4.236


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 00:59:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49675: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 00:59:49 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43624: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.236
country_id: 2635167
description:
2026-02-02 00:59:04 dovecot_login authenticator failed for H=(hGOY5qFT6q) [185.169.4.236]:55183: 535 Incorrect authentication data (set_id=celine@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 00:59:08 dovecot_login authenticator failed for H=(gYBcTE5A) [178.16.52.139]:53671: 535 Incorrect authentication data (set_id=leong@ktlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.236
country_id: 2635167
description:
Feb  2 00:59:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.169.4.236


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 00:59:19 dovecot_login authenticator failed for H=(52jUMA9AM) [158.94.208.175]:61568: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.230.20.155
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=174516 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 00:59:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account leong@ktlog.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/radiation.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-02 00:59:14 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:53824: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.130.146.31
country_id: 6251999
description:
2026-02-02 00:59:19 dovecot_login authenticator failed for H=31.146.130.34.bc.googleusercontent.com (10.188.0.2) [34.130.146.31]:64973: 535 Incorrect authentication data (set_id=2096logoutfasya@pftfood.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ahfengineering.com.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:80c099bd4223c40134b1a22084c0209f36579ec8||Title:0xe774b238||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 185.169.4.236
country_id: 2635167
description:
Feb  2 01:00:56 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account jacklim@ktlog.com.my has been temporarily locked by Imunify PAM(185.169.4.236)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.205.115.105
country_id: 1819730
domain: maalloys.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home2/maalloyscom/public_html/wp-admin||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.236
country_id: 2635167
description:
Feb  2 01:00:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.169.4.236


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.169.4.236
country_id: 2635167
description:
2026-02-02 01:00:20 dovecot_login authenticator failed for H=(6gSlMTB) [185.169.4.236]:54146: 535 Incorrect authentication data (set_id=jacklim@ktlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 01:00:24 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account leong@ktlog.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 01:00:39 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52039: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 01:00:06 dovecot_login authenticator failed for H=(pIFxbC8) [158.94.208.175]:62077: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.123.219.137
country_id: 1835841
description:
2026-02-02 01:00:36 dovecot_login authenticator failed for H=([203.123.219.137]) [203.123.219.137]:45475: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 01:00:07 dovecot_login authenticator failed for H=(MtR3JtQmh6) [178.16.52.139]:54171: 535 Incorrect authentication data (set_id=admin@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-02-02 01:00:17 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:55782: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-02-02 01:00:44 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:1409: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/img/demos/img/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.236
country_id: 2635167
description:
2026-02-02 01:00:12 dovecot_login authenticator failed for H=(yqjIwqWf) [185.169.4.236]:52228: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ahfengineering.com.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:48c7567f4e20978fffdf7381a8fb6b6e86971caa||Title:0xfef7bc71||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.169.4.236
country_id: 2635167
description:
2026-02-02 01:01:47 dovecot_login authenticator failed for H=(HQUFwj7m4s) [185.169.4.236]:54665: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 01:02:00 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.236
country_id: 2635167
description:
Feb  2 01:01:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.169.4.236


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ahfengineering.com.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:632e8b5060bcf60b9e84121764fa6f0fd20a3baf||Title:0x1f4a0668||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 01:01:27 dovecot_login authenticator failed for H=(En2eY7) [178.16.52.139]:57372: 535 Incorrect authentication data (set_id=admin@cordage.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.196.194.83
country_id: 1835841
domain: stillman.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/stillman/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 01:01:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52039: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.159.71.249
country_id: 1835841
description:
2026-02-02 01:01:38 dovecot_login authenticator failed for H=([121.159.71.249]) [121.159.71.249]:38094: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 01:01:16 dovecot_login authenticator failed for H=(wbDBzC) [158.94.208.175]:52066: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 01:01:42 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account leong@ktlog.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.236
country_id: 2635167
description:
2026-02-02 01:01:09 dovecot_login authenticator failed for H=(HN3ldIi7O) [185.169.4.236]:63772: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 185.169.4.236
country_id: 2635167
description:
Feb  2 01:01:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account jacklim@ktlog.com.my has been temporarily locked by Imunify PAM(185.169.4.236)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-02 01:01:52 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:39796: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 01:02:02 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55250: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.236
country_id: 2635167
description:
2026-02-02 01:02:07 dovecot_login authenticator failed for H=(F7u9IAm3) [185.169.4.236]:58613: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 01:02:02 dovecot_login authenticator failed for H=(vSzo9EH) [158.94.208.175]:60969: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 01:02:03 dovecot_login authenticator failed for H=(iWH08w) [178.16.52.139]:51965: 535 Incorrect authentication data (set_id=admin@cordage.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 185.169.4.236
country_id: 2635167
description:
Feb  2 01:02:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account jacklim@ktlog.com.my has been temporarily locked by Imunify PAM(185.169.4.236)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 01:02:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account leong@ktlog.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 01:02:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ahfengineering.com.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5ee7fde6f9b6a572c9fadffbaa28b844dce8300f||Title:0xf3342e93||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 01:02:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64155: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.236
country_id: 2635167
description:
Feb  2 01:02:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.169.4.236


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 143.137.223.88
country_id: 3469034
domain: cordage.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:25070.cordage.com.my||ServerName:cordage.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:87f3b63ac4abaec27c1fba37d638afc4364633a4||Title:0xf7f8d28d||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ahfengineering.com.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:20e374178070764793fc62a9d3a7e9fff8352d98||Title:0x2bc9011d||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350423
name: IM360 WAF: Unauthenticated Stored XSS via Avatar Block in WordPress Core < 6.5.2 (CVE-2024-4439)
abuser: 45.59.186.60
country_id: 6252001
domain: tst-ma.com
description:
IM360 WAF: Unauthenticated Stored XSS via Avatar Block in WordPress Core < 6.5.2 (CVE-2024-4439)||MVN:ARGS:author||MV:<a href=\"https://bestcasinobangladesh.online/\">bestcasinobgnjPi</a>||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.236
country_id: 2635167
description:
2026-02-02 01:03:06 dovecot_login authenticator failed for H=(wNpi5OwEyG) [185.169.4.236]:56250: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.61.36.22
country_id: 1835841
description:
2026-02-02 01:03:36 dovecot_login authenticator failed for H=([125.61.36.25]) [125.61.36.22]:50859: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.236
country_id: 2635167
description:
Feb  2 01:03:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.169.4.236


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 01:03:28 dovecot_login authenticator failed for H=(wHsvGLQbU) [178.16.52.139]:59953: 535 Incorrect authentication data (set_id=admin@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.22
country_id: 1149361
description:
2026-02-02 01:03:19 dovecot_login authenticator failed for H=([149.54.62.22]) [149.54.62.22]:34331: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 01:03:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59938: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 01:03:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 185.169.4.236
country_id: 2635167
description:
Feb  2 01:03:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account jacklim@ktlog.com.my has been temporarily locked by Imunify PAM(185.169.4.236)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 01:03:12 dovecot_login authenticator failed for H=(G0VrmK) [158.94.208.175]:61744: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.169.4.236
country_id: 2635167
description:
2026-02-02 01:03:13 dovecot_login authenticator failed for H=(uuaNVpic) [185.169.4.236]:58222: 535 Incorrect authentication data (set_id=celine@ktlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 01:04:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 01:04:21 dovecot_login authenticator failed for H=(MhoxwDaPl) [158.94.208.175]:49223: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.236
country_id: 2635167
description:
2026-02-02 01:04:04 dovecot_login authenticator failed for H=(yIjdSygr1) [185.169.4.236]:53985: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.87.171.107
country_id: 272103
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/resources/views/admin/working_hours/index.blade.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 01:04:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59936: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 01:04:28 dovecot_login authenticator failed for H=(CuTGLt) [178.16.52.139]:53217: 535 Incorrect authentication data (set_id=admin@cordage.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ahfengineering.com.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4d023412237ec3b9c1b1fbcab38e7419f7e8a62b||Title:0x6f05ede3||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.169.4.236
country_id: 2635167
description:
2026-02-02 01:04:48 dovecot_login authenticator failed for H=(wrTlHgtt) [185.169.4.236]:63210: 535 Incorrect authentication data (set_id=jacklim@ktlog.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 185.169.4.236
country_id: 2635167
description:
Feb  2 01:04:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account jacklim@ktlog.com.my has been temporarily locked by Imunify PAM(185.169.4.236)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.236
country_id: 2635167
description:
Feb  2 01:04:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine@ktlog.com.my has been locked for the attacker IP 185.169.4.236


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 01:04:12 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39330: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.236
country_id: 2635167
description:
2026-02-02 01:05:07 dovecot_login authenticator failed for H=(fYSOMXd) [185.169.4.236]:50813: 535 Incorrect authentication data (set_id=jacklim@ktlog.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ahfengineering.com.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0ba613990ad330ae1aed013552e29629e6ddbb48||Title:0xc0c14a99||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 01:05:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.236
country_id: 2635167
description:
Feb  2 01:05:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine@ktlog.com.my has been locked for the attacker IP 185.169.4.236


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 01:05:07 dovecot_login authenticator failed for H=(KGzR0Rz) [158.94.208.175]:61257: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 01:05:36 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61790: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.177.204.4
country_id: 1269750
description:
2026-02-02 01:05:43 dovecot_login authenticator failed for H=([103.177.204.4]) [103.177.204.4]:41668: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 01:05:52 dovecot_login authenticator failed for H=(TA0btWT) [178.16.52.139]:50859: 535 Incorrect authentication data (set_id=admin@cordage.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 185.169.4.236
country_id: 2635167
description:
Feb  2 01:05:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account jacklim@ktlog.com.my has been temporarily locked by Imunify PAM(185.169.4.236)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-02-02 01:05:59 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:30944: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-02-02 01:06:46 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:49373: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.236
country_id: 2635167
description:
2026-02-02 01:06:04 dovecot_login authenticator failed for H=(VmfpUlGBxF) [185.169.4.236]:62009: 535 Incorrect authentication data (set_id=jacklim@ktlog.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.169.4.236
country_id: 2635167
description:
2026-02-02 01:06:17 dovecot_login authenticator failed for H=(dCd1MYq8) [185.169.4.236]:63923: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 01:06:21 dovecot_login authenticator failed for H=(NROyOjW2yx) [178.16.52.139]:61042: 535 Incorrect authentication data (set_id=admin@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 01:06:23 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39444: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 01:06:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53816: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 01:06:16 dovecot_login authenticator failed for H=(cd7qfg2) [158.94.208.175]:50475: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.236
country_id: 2635167
description:
Feb  2 01:06:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine@ktlog.com.my has been locked for the attacker IP 185.169.4.236


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 01:06:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
country_id: 1835841
description:
2026-02-02 01:06:56 dovecot_login authenticator failed for H=([220.95.14.102]) [220.95.14.102]:48348: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ahfengineering.com.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:055dd3423f1a101fcc7851cf51127150c95f1c07||Title:0xf1eb5d66||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ahfengineering.com.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:51959b3beb707f0a38ab0cae5036bfa5f7a3c99d||Title:0x54e00392||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2026-02-02 01:07:46 dovecot_plain authenticator failed for H=(coreb) [5.32.99.14]:37722: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.143.200.118
country_id: 690791
description:
2026-02-02 01:07:59 dovecot_login authenticator failed for H=(host118-200-143-83.reedlan.com) [83.143.200.118]:40923: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.3
country_id: 1814991
description:
2026-02-02 01:07:11 dovecot_login authenticator failed for H=([111.61.177.3]) [111.61.177.3]:30502: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 01:07:28 dovecot_login authenticator failed for H=(GHTLXxgd) [178.16.52.139]:49889: 535 Incorrect authentication data (set_id=admin@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 01:07:17 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63269: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.236
country_id: 2635167
description:
Feb  2 01:07:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.169.4.236


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.169.4.236
country_id: 2635167
description:
2026-02-02 01:07:40 dovecot_login authenticator failed for H=(WeqMkexjoj) [185.169.4.236]:60505: 535 Incorrect authentication data (set_id=celine@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 01:07:02 dovecot_login authenticator failed for H=(xAVIBV9whK) [158.94.208.175]:54457: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.236
country_id: 2635167
description:
2026-02-02 01:07:01 dovecot_login authenticator failed for H=(hw3oPaM8vI) [185.169.4.236]:54191: 535 Incorrect authentication data (set_id=jacklim@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 01:08:29 dovecot_login authenticator failed for H=(wm5zufbptg) [178.16.52.139]:59779: 535 Incorrect authentication data (set_id=admin@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 01:08:37 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:60938: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.236
country_id: 2635167
description:
Feb  2 01:08:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.169.4.236


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-02-02 01:08:27 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:58475: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2026-02-02 01:08:46 dovecot_login authenticator failed for H=(nsg-corporate-36.229.187.122.airtel.in) [122.187.229.36]:46283: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 01:08:11 dovecot_login authenticator failed for H=(JWeUjzY) [158.94.208.175]:53115: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.236
country_id: 2635167
description:
2026-02-02 01:08:13 dovecot_login authenticator failed for H=(zRwgmrv) [185.169.4.236]:50004: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 01:08:16 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55968: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.108.228.36
country_id: 1269750
domain: ahfengineering.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ahfengineering.com.ahfengineering.com||ServerName:ahfengineering.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0c1847bfabe1d298d9db9c7cae53bc3f60db60f4||Title:0x76e10ea0||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 185.169.4.236
country_id: 2635167
description:
Feb  2 01:08:35 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account jacklim@ktlog.com.my has been temporarily locked by Imunify PAM(185.169.4.236)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.30.21
country_id: 1562822
description:
2026-02-02 01:08:08 dovecot_login authenticator failed for H=([27.71.30.21]) [27.71.30.21]:47854: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.236
country_id: 2635167
description:
2026-02-02 01:09:11 dovecot_login authenticator failed for H=(aO4jjMlIA) [185.169.4.236]:62601: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 01:09:06 dovecot_login authenticator failed for H=(XGFJXLn4Ro) [178.16.52.139]:57679: 535 Incorrect authentication data (set_id=admin@cordage.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 185.169.4.236
country_id: 2635167
description:
Feb  2 01:09:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account jacklim@ktlog.com.my has been temporarily locked by Imunify PAM(185.169.4.236)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.169.4.236
country_id: 2635167
description:
2026-02-02 01:09:15 dovecot_login authenticator failed for H=(YOoPXAY) [185.169.4.236]:63454: 535 Incorrect authentication data (set_id=jacklim@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 01:09:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58222: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2026-02-02 01:09:36 dovecot_login authenticator failed for H=([220.93.167.144]) [220.93.167.144]:33724: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.236
country_id: 2635167
description:
Feb  2 01:09:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.169.4.236


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 01:09:20 dovecot_login authenticator failed for H=(EFpetUh) [158.94.208.175]:55418: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2026-02-02 01:09:21 dovecot_login authenticator failed for H=([121.179.93.147]) [121.179.93.147]:37968: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2026-02-02 01:10:11 dovecot_login authenticator failed for H=(228.pool90-161-217.static.orange.es) [90.161.217.228]:39291: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 01:10:16 dovecot_login authenticator failed for H=(2tmJwC) [178.16.52.139]:62759: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2026-02-02 01:10:42 dovecot_login authenticator failed for H=([59.145.74.209]) [122.184.120.98]:59394: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


