# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2026-01-31 00:01:59 dovecot_login authenticator failed for H=([169.211.232.182]) [169.211.232.182]:40674: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.46
country_id: 6252001
description:
2026-01-31  0:01:30 600 [Warning] Aborted connection 600 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.46' (This connection closed normally without authentication)


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.20.94
country_id: 1814991
domain: www.manforce.net
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.52.222
country_id: 1814991
domain: www.manforce.net
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 59.62.64.199
country_id: 1814991
domain: www.manforce.net
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.44.72
country_id: 1814991
domain: www.manforce.net
description:


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.135.92.229
country_id: 1643084
description:
[2026-01-31 00:01:12 +0800] info [cpaneld] 95.135.92.229 - kitty.yap@manforce.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:01:21 dovecot_login authenticator failed for H=(yyo2qCP2v) [158.94.208.175]:52200: 535 Incorrect authentication data (set_id=plsu.fpp)


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.238.10
country_id: 1814991
domain: www.manforce.net
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.98.61.61
country_id: 1814991
domain: www.manforce.net
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:01:03 dovecot_login authenticator failed for H=(y4qgOWH) [185.230.124.69]:50214: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.164.242
country_id: 1814991
domain: www.manforce.net
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.30.57
country_id: 1814991
domain: www.manforce.net
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.164.163
country_id: 1814991
domain: www.manforce.net
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 117.43.188.89
country_id: 1814991
domain: www.manforce.net
description:


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:02:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:02:04 dovecot_login authenticator failed for H=(f1SKpx) [185.230.124.69]:51936: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:02:19 dovecot_login authenticator failed for H=(w3W4apT) [158.94.208.175]:52531: 535 Incorrect authentication data (set_id=plsu.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:03:19 dovecot_login authenticator failed for H=(2ARH3Mx) [158.94.208.175]:56821: 535 Incorrect authentication data (set_id=plsu.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:03:19 dovecot_login authenticator failed for H=(accSLFvw) [185.230.124.69]:64598: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:03:44 dovecot_login authenticator failed for H=(NiPvmsY3) [185.230.124.69]:62909: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2026-01-31 00:03:04 dovecot_plain authenticator failed for H=c-71-235-225-181.hsd1.ct.comcast.net (searte) [71.235.225.181]:47338: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/demos/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:03:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.123.118
country_id: 1269750
description:
2026-01-31 00:04:24 dovecot_login authenticator failed for H=([122.184.123.118]) [122.184.123.118]:46132: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.132.228.211
country_id: 1814991
description:
2026-01-31 00:04:14 dovecot_login authenticator failed for H=([59.110.5.198]) [36.132.228.211]:10471: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/img/druma_photos/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:04:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:04:09 dovecot_login authenticator failed for H=(x3PsPu5uOt) [185.230.124.69]:62253: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/demos/img/img/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:04:19 dovecot_login authenticator failed for H=(XKnCQ5) [158.94.208.175]:58199: 535 Incorrect authentication data (set_id=plsu.fpp)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/apm/images/career.php||SC:/home/sutsbcom/public_html/wp-content/themes/apm||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-01-31 00:05:36 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:38834: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.50.119.110
country_id: 1814991
description:
2026-01-31 00:05:38 dovecot_login authenticator failed for H=(eminent.st) [61.50.119.110]:52874: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:05:48 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/plug/sms/img/img/clientele.php||SC:/home2/pspolycom/public_html/plug||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:05:19 dovecot_login authenticator failed for H=(jBZPEKynO) [185.230.124.69]:55188: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 00:05:43 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account plsu.fpp has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:05:45 dovecot_login authenticator failed for H=(61gEHPU9b) [158.94.208.175]:55055: 535 Incorrect authentication data (set_id=plsu.fpp)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:06:40 dovecot_login authenticator failed for H=(LUD6jAxwnR) [185.230.124.69]:65394: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-31 00:06:45 +0800] info [cpaneld] 202.178.120.157 - Intercessors@agpc.org.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.50.119.110
country_id: 1814991
description:
2026-01-31 00:06:03 dovecot_login authenticator failed for H=(eminent.st) [61.50.119.110]:56944: 535 Incorrect authentication data (set_id=postmaster@eminent.st)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 00:06:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account plsu.fpp has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:06:10 dovecot_login authenticator failed for H=(xhEl9KM) [185.230.124.69]:60330: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:06:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:06:13 dovecot_login authenticator failed for H=(cUzI7tor7) [158.94.208.175]:49888: 535 Incorrect authentication data (set_id=plsu.fpp)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.223.96.43
country_id: 2661886
domain: aire-fresh.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home/airefresh/public_html/assets/images||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 00:07:42 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account plsu.fpp has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:07:44 dovecot_login authenticator failed for H=(MmHpPrve) [158.94.208.175]:65395: 535 Incorrect authentication data (set_id=plsu.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:07:01 dovecot_login authenticator failed for H=(TTD1Uj9M) [185.230.124.69]:64830: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:07:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.227.63.227
country_id: 2921044
description:
2026-01-31 00:07:50 dovecot_plain authenticator failed for H=([212.227.63.227]) [212.227.63.227]:61926: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.210.129.89
country_id: 1861060
domain: mail.evergrown.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/evergrown/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:08:04 dovecot_login authenticator failed for H=(UUAbsnd1F) [185.230.124.69]:52204: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:08:16 dovecot_login authenticator failed for H=(C0KvERe09) [158.94.208.175]:49805: 535 Incorrect authentication data (set_id=plsu.fpp)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 00:08:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account plsu.fpp has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:08:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:09:07 dovecot_login authenticator failed for H=(Z6nBrV) [185.230.124.69]:50888: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 00:09:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account plsu.fpp has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:09:15 dovecot_login authenticator failed for H=(iU5G7K) [185.230.124.69]:54427: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:09:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:09:15 dovecot_login authenticator failed for H=(hMxBUGLnbb) [158.94.208.175]:59340: 535 Incorrect authentication data (set_id=plsu.fpp)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.209.123.2
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=47191514863574 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:10:07 dovecot_login authenticator failed for H=(AyRtkxHs) [185.230.124.69]:55455: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:10:17 dovecot_login authenticator failed for H=(uZ7zYN) [158.94.208.175]:52763: 535 Incorrect authentication data (set_id=plsu.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.101.79.13
country_id: 1814991
description:
2026-01-31 00:10:26 dovecot_login authenticator failed for H=([114.101.79.13]) [114.101.79.13]:50414: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.233.246
country_id: 1269750
description:
2026-01-31 00:10:40 dovecot_login authenticator failed for H=([125.17.236.223]) [125.17.233.246]:36312: 535 Incorrect authentication data (set_id=zainuddin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.90.80.45
country_id: 2328926
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/many/54/546485 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:10:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/symfony/http-foundation/Tests/Session/Storage/Handler/Fixtures/common.inc||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:11:04 dovecot_login authenticator failed for H=(lnVB9t) [185.230.124.69]:63503: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:11:16 dovecot_login authenticator failed for H=(IaeKddOKKY) [158.94.208.175]:56004: 535 Incorrect authentication data (set_id=plsu.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:12:12 dovecot_login authenticator failed for H=(7ibwJgbFu7) [185.230.124.69]:55049: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 15.204.94.173
country_id: 6252001
description:
2026-01-31 00:12:28 dovecot_login authenticator failed for H=vps-63db5216.vps.ovh.us [15.204.94.173]:53798: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.154
country_id: 1269750
description:
2026-01-31 00:12:44 dovecot_login authenticator failed for H=([182.95.178.154]) [182.95.178.154]:52640: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:12:18 dovecot_login authenticator failed for H=(oZ38prIL0) [158.94.208.175]:64341: 535 Incorrect authentication data (set_id=plsu.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 00:12:06 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (sigianet) [87.103.126.54]:30668: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:12:12 dovecot_login authenticator failed for H=(3wJOEyz) [185.230.124.69]:55209: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-01-31 00:12:40 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:57336: 535 Incorrect authentication data (set_id=rajanazrul@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.72.235.193
country_id: 2017370
description:
2026-01-31 00:13:32 dovecot_login authenticator failed for H=(4C5E0C0DE7C6.mldns.ru) [109.72.235.193]:48170: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-01-31 00:13:52 dovecot_login authenticator failed for H=([196.189.59.226]) [196.189.59.226]:53878: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.11.231.242
country_id: 1814991
description:
2026-01-31 00:13:15 dovecot_login authenticator failed for H=([1.15.123.146]) [175.11.231.242]:40298: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:13:16 dovecot_login authenticator failed for H=(nx1MR9iD) [158.94.208.175]:53497: 535 Incorrect authentication data (set_id=plsu.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.170.150.178
country_id: 1605651
description:
2026-01-31 00:13:18 dovecot_login authenticator failed for H=([203.170.150.178]) [203.170.150.178]:55538: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.66.231
country_id: 3469034
description:
2026-01-31 00:13:40 dovecot_login authenticator failed for H=(industrianaval.fla.gvt.net.br) [187.58.66.231]:47557: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:13:01 dovecot_login authenticator failed for H=(dNv8jmUfB) [185.230.124.69]:60019: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2026-01-31 00:13:10 dovecot_login authenticator failed for H=syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:41898: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2026-01-31 00:13:55 dovecot_login authenticator failed for H=(nsg-static-145.58.71.182.airtel.in) [27.123.102.50]:47218: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2026-01-31 00:13:03 dovecot_login authenticator failed for H=([121.179.93.147]) [121.179.93.147]:55412: 535 Incorrect authentication data (set_id=rajanazrul)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.196.134
country_id: 1814991
description:
2026-01-31 00:14:14 dovecot_login authenticator failed for H=([220.189.196.134]) [220.189.196.134]:45109: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:14:15 dovecot_login authenticator failed for H=(oxuy2Jkts0) [158.94.208.175]:49911: 535 Incorrect authentication data (set_id=plsu.fpp)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.210.129.89
country_id: 1861060
domain: egbwawasan.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/egbwawasancom/public_html/wp-includes||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:14:52 dovecot_login authenticator failed for H=(sYiEgvvz) [185.230.124.69]:61974: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:14:31 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.234.195.41
country_id: 1814991
description:
2026-01-31 00:14:33 dovecot_login authenticator failed for H=([120.234.195.41]) [120.234.195.41]:49618: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.255.50
country_id: 1269750
description:
2026-01-31 00:14:41 dovecot_login authenticator failed for H=([182.95.203.81]) [122.186.255.50]:42998: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:14:07 dovecot_login authenticator failed for H=(EbRGlxrC) [185.230.124.69]:63402: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.74.194.86
country_id: 1522867
description:
2026-01-31 00:14:40 dovecot_login authenticator failed for H=(2-74-194-86.kcell.kz) [2.74.194.86]:33322: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.42.67.114
country_id: 1814991
description:
2026-01-31 00:14:22 dovecot_login authenticator failed for H=([36.42.67.114]) [36.42.67.114]:34628: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:15:17 dovecot_login authenticator failed for H=(F3gncZ) [185.230.124.69]:57885: 535 Incorrect authentication data (set_id=astpkg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.165.143.222
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=8&page_id=2&sub=12 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 00:15:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account plsu.fpp has been locked for the attacker IP 158.94.208.175


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 178.90.173.180
country_id: 1522867
domain: www.maalloys.com.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.71||T:APACHE||RA:178.90.173.180||TA:178.90.173.180||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:15:13 dovecot_login authenticator failed for H=(KE6TAmA) [158.94.208.175]:52672: 535 Incorrect authentication data (set_id=plsu.fpp)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:15:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:16:02 dovecot_login authenticator failed for H=(8weDhg9) [185.230.124.69]:58714: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 00:16:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account plsu.fpp has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:16:00 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:16:12 dovecot_login authenticator failed for H=(VIhj5MLI) [158.94.208.175]:55558: 535 Incorrect authentication data (set_id=plsu.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2026-01-31 00:17:45 dovecot_login authenticator failed for H=ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:55838: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:17:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.190.238.234
country_id: 2017370
description:
2026-01-31 00:17:20 dovecot_login authenticator failed for H=(91-190-238-234.in-addr.netone.ru) [91.190.238.234]:56676: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:17:44 dovecot_login authenticator failed for H=(V2hysZG9rk) [185.230.124.69]:54791: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 00:17:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account plsu.fpp has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:17:11 dovecot_login authenticator failed for H=(6mgb5lUP) [158.94.208.175]:49626: 535 Incorrect authentication data (set_id=plsu.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:17:12 dovecot_login authenticator failed for H=(eA9RDjS1) [185.230.124.69]:49710: 535 Incorrect authentication data (set_id=andrew.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.149.30.186
country_id: 2017370
description:
2026-01-31 00:17:54 dovecot_login authenticator failed for H=([83.149.30.186]) [83.149.30.186]:58136: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:18:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:18:09 dovecot_login authenticator failed for H=(wWvl4zt) [185.230.124.69]:64858: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.182.166
country_id: 1269750
description:
2026-01-31 00:18:14 dovecot_login authenticator failed for H=([182.95.182.166]) [182.95.182.166]:34036: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.39.230.40
country_id: 1835841
description:
2026-01-31 00:18:22 dovecot_login authenticator failed for H=([118.39.230.40]) [118.39.230.40]:1724: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2026-01-31 00:18:30 dovecot_login authenticator failed for H=([152.52.12.201]) [152.52.245.38]:47780: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:18:22 dovecot_login authenticator failed for H=(mLHncYRba) [158.94.208.175]:52648: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.200.42.112
country_id: 1880251
description:
2026-01-31 00:18:40 dovecot_login authenticator failed for H=(bb118-200-42-112.singnet.com.sg) [118.200.42.112]:58166: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.216.89.122
country_id: 1814991
description:
2026-01-31 00:18:43 dovecot_login authenticator failed for H=([60.216.89.122]) [60.216.89.122]:37368: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.50.70.34
country_id: 1814991
description:
2026-01-31 00:18:55 dovecot_login authenticator failed for H=([111.50.70.34]) [111.50.70.34]:54811: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.207.33.248
country_id: 6290252
description:
2026-01-31 00:19:07 dovecot_login authenticator failed for H=([109.207.33.248]) [109.207.33.248]:34772: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:19:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.34.151
country_id: 6252001
description:
2026-01-31 00:19:34 dovecot_login authenticator failed for H=(ADMIN) [143.244.34.151]:56215: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 00:19:00 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account plsu.fpp has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:19:02 dovecot_login authenticator failed for H=(QJzAonUj5J) [158.94.208.175]:53786: 535 Incorrect authentication data (set_id=plsu.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:19:14 dovecot_login authenticator failed for H=(T2Fz0GQta6) [185.230.124.69]:63851: 535 Incorrect authentication data (set_id=andrew.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.131
country_id: 2017370
description:
2026-01-31 00:19:47 dovecot_login authenticator failed for H=([178.178.194.131]) [178.178.194.131]:33520: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.145.5.14
country_id: 1835841
description:
2026-01-31 00:20:04 dovecot_login authenticator failed for H=([221.145.5.14]) [221.145.5.14]:57660: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:20:24 dovecot_login authenticator failed for H=(S9PyWaUdc) [158.94.208.175]:63671: 535 Incorrect authentication data (set_id=plsu.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.183.83.136
country_id: 1269750
description:
2026-01-31 00:20:52 dovecot_login authenticator failed for H=(static.bb.alp.117.216.47.84.bsnl.in) [103.183.83.136]:2978: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2026-01-31 00:20:18 dovecot_login authenticator failed for H=([189.108.156.41]) [187.8.64.94]:41979: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.58
country_id: 2017370
description:
2026-01-31 00:20:40 dovecot_login authenticator failed for H=([178.178.222.58]) [178.178.222.58]:51834: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:20:42 dovecot_login authenticator failed for H=(mZZzdV) [185.230.124.69]:62457: 535 Incorrect authentication data (set_id=andrew.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:20:11 dovecot_login authenticator failed for H=(YlJ4vXPJN2) [185.230.124.69]:55447: 535 Incorrect authentication data (set_id=andrew.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:21:03 dovecot_login authenticator failed for H=(TkKa5zaRp) [185.230.124.69]:52468: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:21:29 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:21:12 dovecot_login authenticator failed for H=(vAI4wQKatA) [158.94.208.175]:50380: 535 Incorrect authentication data (set_id=plsu.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:22:11 dovecot_login authenticator failed for H=(HKlzel) [185.230.124.69]:61629: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.170.15
country_id: 3175395
description:
2026-01-31 00:22:35 dovecot_plain authenticator failed for H=([100.64.100.6]) [2.57.170.15]:64941: 535 Incorrect authentication data (set_id=general@kimmark.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:22:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.125.242.139
country_id: 1733045
domain: www.mokshana.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mokshana.com.my/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:22:11 dovecot_login authenticator failed for H=(52yKehMXz) [2.58.56.77]:60618: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:22:10 dovecot_login authenticator failed for H=(4OwdddMLaQ) [158.94.208.175]:55474: 535 Incorrect authentication data (set_id=contact)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.223.168.28
country_id: 2963597
domain: imax.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/admin/upload/css.php||SC:/home2/imaxcom/public_html/admin||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.223.168.28
country_id: 2963597
domain: imax.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/imaxcom/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.25.253.242
country_id: 953987
description:
2026-01-31 00:23:49 dovecot_login authenticator failed for H=([196.25.113.220]) [196.25.253.242]:59655: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 20.223.168.28
country_id: 2963597
domain: imax.com.my
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/seoo/wsoyanz.php||WPU:||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:23:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.223.168.28
country_id: 2963597
domain: imax.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/wp-login.php||SC:/home2/imaxcom/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:23:20 dovecot_login authenticator failed for H=(Y3LdSd3qLt) [2.58.56.77]:64144: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 20.223.168.28
country_id: 2963597
domain: imax.com.my
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:7.71||T:APACHE||MV:/wp-admin/includes/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:23:04 dovecot_login authenticator failed for H=(1wfWvFwo) [185.230.124.69]:62026: 535 Incorrect authentication data (set_id=andrew.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:23:11 dovecot_login authenticator failed for H=(IIo0xd) [158.94.208.175]:49247: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:23:25 dovecot_login authenticator failed for H=(YfzAVgwF) [185.230.124.69]:53849: 535 Incorrect authentication data (set_id=andrew.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.80.11
country_id: 1269750
description:
2026-01-31 00:24:02 dovecot_login authenticator failed for H=([182.156.80.11]) [182.156.80.11]:33970: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:24:03 dovecot_login authenticator failed for H=(n1rP3f5w) [2.58.56.77]:54755: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:24:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:24:12 dovecot_login authenticator failed for H=(dqo2bgCk) [185.230.124.69]:56334: 535 Incorrect authentication data (set_id=andrew.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:24:27 dovecot_login authenticator failed for H=(BrSuq5IWx) [158.94.208.175]:51277: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.190.86.244
country_id: 1269750
domain: euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/euratech.com.my/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:25:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.144.34
country_id: 1269750
description:
2026-01-31 00:25:18 dovecot_login authenticator failed for H=([182.78.144.34]) [182.78.144.34]:56570: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 00:25:29 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.182.65.40
country_id: 3017382
description:
2026-01-31 00:25:43 dovecot_login authenticator failed for H=40.ip-217-182-65.eu [217.182.65.40]:57768: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:25:06 dovecot_login authenticator failed for H=(Tf8sWgvLv1) [185.230.124.69]:55524: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:25:09 dovecot_login authenticator failed for H=(wPqpb30BM4) [2.58.56.77]:60712: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:25:10 dovecot_login authenticator failed for H=(1Y5OyzO9) [158.94.208.175]:49882: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.50
country_id: 1269750
description:
2026-01-31 00:25:20 dovecot_login authenticator failed for H=([125.19.218.50]) [125.19.218.50]:49726: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.91.23.200
country_id: 1835841
description:
2026-01-31 00:25:34 dovecot_login authenticator failed for H=([210.91.23.200]) [210.91.23.200]:51359: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.149.233.246
country_id: 1835841
description:
2026-01-31 00:25:40 dovecot_login authenticator failed for H=([221.149.233.246]) [221.149.233.246]:34385: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:26:19 dovecot_login authenticator failed for H=(tNBbkok) [2.58.56.77]:56398: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 00:26:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:26:13 dovecot_login authenticator failed for H=(VLmf68zH) [158.94.208.175]:58131: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:26:20 dovecot_login authenticator failed for H=(xQSJOX) [185.230.124.69]:50152: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:26:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:26:07 dovecot_login authenticator failed for H=(ftnJjgBgJG) [185.230.124.69]:64209: 535 Incorrect authentication data (set_id=andrew.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:27:09 dovecot_login authenticator failed for H=(iygRQY) [2.58.56.77]:61090: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:27:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:27:03 dovecot_login authenticator failed for H=(4glW6avdvj) [185.230.124.69]:60518: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 00:27:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:27:12 dovecot_login authenticator failed for H=(6cFzd6sS9) [158.94.208.175]:57232: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.46.20.8
country_id: 1835841
description:
2026-01-31 00:28:23 dovecot_login authenticator failed for H=([14.46.20.8]) [14.46.20.8]:45788: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.30.250.62
country_id: 690791
description:
2026-01-31 00:28:30 dovecot_login authenticator failed for H=(undefined.sevstar.net) [78.30.250.62]:56408: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:28:35 dovecot_login authenticator failed for H=(tEGqW30nF) [185.230.124.69]:54124: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-31 00:28:42 H=([64.89.160.15]) [64.89.160.15]:52506 F=<drdavid00r5@outlook.com> rejected RCPT <mustapa@astlog.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:28:22 dovecot_login authenticator failed for H=(vUhqm9m) [2.58.56.77]:58188: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/symfony/translation/Tests/fixtures/empty.ini||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:28:08 dovecot_login authenticator failed for H=(sqZzPn9lWl) [185.230.124.69]:49660: 535 Incorrect authentication data (set_id=andrew.chin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 00:28:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:28:05 dovecot_login authenticator failed for H=(D28c8Ud) [158.94.208.175]:64705: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 00:29:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:29:06 dovecot_login authenticator failed for H=(1ahJ0668) [2.58.56.77]:54488: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:29:10 dovecot_login authenticator failed for H=(ejlwGZT) [158.94.208.175]:57760: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:29:21 dovecot_login authenticator failed for H=(OvX3In) [185.230.124.69]:52309: 535 Incorrect authentication data (set_id=andrew.chin)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.185
country_id: 2750405
description:
2026-01-31  0:29:54 1465 [Warning] Aborted connection 1465 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.185' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 00:30:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account daniel has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.174.104.74
country_id: 2017370
description:
2026-01-31 00:30:39 dovecot_login authenticator failed for H=(host-109-174-104-74.bb-nsk.sib.mts.ru) [109.174.104.74]:53438: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:30:11 dovecot_login authenticator failed for H=(AlZNE5KA) [185.230.124.69]:56481: 535 Incorrect authentication data (set_id=andrew.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.30.170
country_id: 3144096
description:
2026-01-31 00:30:14 dovecot_login authenticator failed for H=(cm-178.232.30.170.get.no) [178.232.30.170]:39210: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:30:14 dovecot_login authenticator failed for H=(YLGbpuPAMA) [2.58.56.77]:64141: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:30:06 dovecot_login authenticator failed for H=(UGyZvf7gsJ) [158.94.208.175]:59560: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:30:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/iso.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.201.52
country_id: 1814991
description:
2026-01-31 00:30:28 dovecot_login authenticator failed for H=([58.16.201.52]) [58.16.201.52]:59725: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-01-31 00:30:29 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:58652: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:31:12 dovecot_login authenticator failed for H=(rz3a8qad) [158.94.208.175]:61272: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.156.152.152
country_id: 732800
description:
2026-01-31 00:31:09 H=([94.156.152.152]) [94.156.152.152]:60233 F=<altawashtrading_15@yahoo.com> rejected RCPT <sales@wohcheong.com.my>: Unrouteable address


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:31:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:31:02 dovecot_login authenticator failed for H=(LJVCvjM2g1) [185.230.124.69]:51552: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:31:02 dovecot_login authenticator failed for H=(O58tPRt) [158.94.208.175]:53346: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.162.173.158
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=844999 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:31:22 dovecot_login authenticator failed for H=(sxBFuBA) [2.58.56.77]:52065: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 00:31:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account daniel has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
country_id: 6252001
description:
2026-01-31 00:32:48 dovecot_login authenticator failed for H=([50.217.255.171]) [50.217.255.171]:47603: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 00:32:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account daniel has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:32:05 dovecot_login authenticator failed for H=(OjMkscBO) [2.58.56.77]:59138: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:32:06 dovecot_login authenticator failed for H=(MyjNJjl) [158.94.208.175]:61518: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.200.166
country_id: 149590
description:
2026-01-31 00:32:57 dovecot_login authenticator failed for H=(166.200-59-41.ttcl.co.tz) [41.59.200.166]:53202: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:32:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:32:04 dovecot_login authenticator failed for H=(bVskv4) [185.230.124.69]:58944: 535 Incorrect authentication data (set_id=andrew.chin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:33:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:33:19 dovecot_login authenticator failed for H=(zGPi85M9L) [185.230.124.69]:62682: 535 Incorrect authentication data (set_id=andrew.chin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 00:33:40 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account daniel has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:33:01 dovecot_login authenticator failed for H=(bpVsSS) [158.94.208.175]:51517: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:33:12 dovecot_login authenticator failed for H=(zdtLb2o) [2.58.56.77]:64221: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:33:14 dovecot_login authenticator failed for H=(XmqZPVw) [185.230.124.69]:56527: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 00:33:53 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:34:05 dovecot_login authenticator failed for H=(K6Jat8) [185.230.124.69]:61545: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:34:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 00:34:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account daniel has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:34:10 dovecot_login authenticator failed for H=(9RIjUk3jf) [158.94.208.175]:60570: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 00:34:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:34:20 dovecot_login authenticator failed for H=(tHZy8tQW) [2.58.56.77]:59091: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.134
country_id: 2017370
description:
2026-01-31 00:34:27 dovecot_login authenticator failed for H=([178.178.194.134]) [178.178.194.134]:38962: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.127.128
country_id: 3144096
description:
2026-01-31 00:34:45 dovecot_login authenticator failed for H=(cm-46.212.127.128.get.no) [46.212.127.128]:33145: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2026-01-31 00:35:02 dovecot_login authenticator failed for H=([197.219.228.250]) [197.219.228.250]:59292: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:35:04 dovecot_login authenticator failed for H=(lnajpQa7dJ) [158.94.208.175]:57217: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:35:08 dovecot_login authenticator failed for H=(wVyUxHvp) [2.58.56.77]:49652: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:35:01 dovecot_login authenticator failed for H=(RbmDNPFhrj) [185.230.124.69]:59069: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/symfony/finder/Tests/Fixtures/A/B/C/abc.dat||User:visoftcom||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 00:35:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.83.134.101
country_id: 3469034
description:
2026-01-31 00:36:48 dovecot_login authenticator failed for H=(179.83.135.1.dynamic.adsl.gvt.net.br) [179.83.134.101]:49816: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.114
country_id: 1835841
description:
2026-01-31 00:36:56 dovecot_login authenticator failed for H=([1.250.67.114]) [1.250.67.114]:52816: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.218.26
country_id: 1269750
description:
2026-01-31 00:36:56 dovecot_login authenticator failed for H=(nsg-corporate-191.126.187.122.airtel.in) [182.66.218.26]:44916: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 00:36:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:36:14 dovecot_login authenticator failed for H=(NZD02Ju9P) [185.230.124.69]:59506: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.249
country_id: 1168579
description:
2026-01-31 00:36:42 dovecot_login authenticator failed for H=(249.92.zcomnetworks.com.pk) [103.148.92.249]:36666: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:36:06 dovecot_login authenticator failed for H=(FyQmaj) [158.94.208.175]:58379: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:36:12 dovecot_login authenticator failed for H=(EQoUMM1) [185.230.124.69]:57500: 535 Incorrect authentication data (set_id=andrew.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:36:16 dovecot_login authenticator failed for H=(HtBXTPK) [2.58.56.77]:51805: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:37:04 dovecot_login authenticator failed for H=(o6vJnFrNs) [185.230.124.69]:59084: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:37:49 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:37:03 dovecot_login authenticator failed for H=(wU5yfV) [2.58.56.77]:56538: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:37:06 dovecot_login authenticator failed for H=(dia00QO) [158.94.208.175]:52779: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 00:37:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.236.251
country_id: 1814991
domain: www.symphony-led.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.238.2
country_id: 1814991
domain: www.symphony-led.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.164.29
country_id: 1814991
domain: www.symphony-led.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.162.254
country_id: 1814991
domain: www.symphony-led.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 220.175.82.138
country_id: 1814991
domain: www.symphony-led.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 117.43.184.19
country_id: 1814991
domain: www.symphony-led.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.164.18
country_id: 1814991
domain: www.symphony-led.com
description:


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 00:38:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.215.235.125
country_id: 1831722
description:
2026-01-31 00:38:12 dovecot_login authenticator failed for H=(ADMIN) [188.215.235.125]:32168: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:38:08 dovecot_login authenticator failed for H=(plz7Yo) [2.58.56.77]:52102: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.164.172
country_id: 1814991
domain: www.symphony-led.com
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:38:17 dovecot_login authenticator failed for H=(pj55iN8Tk7) [158.94.208.175]:63773: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:38:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 111.78.110.3
country_id: 1814991
domain: www.symphony-led.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.237.109
country_id: 1814991
domain: www.symphony-led.com
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:38:13 dovecot_login authenticator failed for H=(bAakduKjp0) [185.230.124.69]:54306: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 52.4.193.97
country_id: 6252001
domain: www.cpcontacts.vc-b.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/132.0.0.0 Safari/537.36||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.63.87
country_id: 1814991
description:
2026-01-31 00:39:47 dovecot_login authenticator failed for H=([111.26.63.86]) [111.26.63.87]:35530: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:39:00 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:39:22 dovecot_login authenticator failed for H=(Wmq3eMW) [2.58.56.77]:57612: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.59.6.81
country_id: 1668284
description:
2026-01-31 00:39:31 dovecot_login authenticator failed for H=(h81-61-59-6.seed.net.tw) [61.59.6.81]:40394: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:39:02 dovecot_login authenticator failed for H=(8cWnOZ7) [185.230.124.69]:50781: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:39:16 dovecot_login authenticator failed for H=(Rn28RTWg) [158.94.208.175]:53866: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:40:09 dovecot_login authenticator failed for H=(R2Kkeywu) [2.58.56.77]:54359: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:40:06 dovecot_login authenticator failed for H=(nK3dsIa) [185.230.124.69]:55947: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:40:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2026-01-31 00:40:11 dovecot_plain authenticator failed for H=c-76-145-10-140.hsd1.ga.comcast.net (monstal) [76.145.10.140]:37214: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.11.39.245
country_id: 2510769
description:
2026-01-31 00:40:27 dovecot_login authenticator failed for H=245.red-88-11-39.dynamicip.rima-tde.net [88.11.39.245]:56848: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:40:04 dovecot_login authenticator failed for H=(AaywRS) [158.94.208.175]:64979: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:40:48 dovecot_login authenticator failed for H=(7EgnsIBnH) [185.230.124.69]:57941: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2026-01-31 00:41:01 dovecot_login authenticator failed for H=(163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:37597: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:41:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:41:10 dovecot_login authenticator failed for H=(h0FzHM) [185.230.124.69]:52893: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:41:13 dovecot_login authenticator failed for H=(Li9CvfLe3Z) [2.58.56.77]:56482: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.23
country_id: 1269750
description:
2026-01-31 00:41:19 dovecot_login authenticator failed for H=([103.147.248.23]) [103.147.248.23]:35282: 535 Incorrect authentication data (set_id=ysl)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.187.206.251
country_id: 99237
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=21 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.96.29.14
country_id: 1269750
description:
2026-01-31 00:41:10 dovecot_login authenticator failed for H=(aes-static-075.124.17.125.airtel.in) [14.96.29.14]:60354: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:41:13 dovecot_login authenticator failed for H=(xTc0gMDe) [158.94.208.175]:59499: 535 Incorrect authentication data (set_id=enquiry)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.32
country_id: 6252001
domain: www.xls.mokshana.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/Build/build-release-standard.bat||User:mokshanacom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:42:18 dovecot_login authenticator failed for H=(RRLhcXyZp) [158.94.208.175]:63364: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:42:13 dovecot_login authenticator failed for H=(1tr7S02FDq) [185.230.124.69]:55708: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.32
country_id: 6252001
domain: www.xls.mokshana.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/bin/phpcbf.bat||User:mokshanacom||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 00:42:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.169.52.67
country_id: 2017370
description:
2026-01-31 00:42:42 dovecot_login authenticator failed for H=([193.169.52.67]) [193.169.52.67]:54666: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:42:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:42:21 dovecot_login authenticator failed for H=(fsYtMz) [2.58.56.77]:60236: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.238.252.46
country_id: 241170
description:
2026-01-31 00:42:29 dovecot_login authenticator failed for H=([156.238.252.46]) [156.238.252.46]:59670: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:43:08 dovecot_login authenticator failed for H=(49azAx1q) [2.58.56.77]:61923: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 00:43:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:43:58 dovecot_login authenticator failed for H=(UqzSxbe) [158.94.208.175]:64558: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:43:02 dovecot_login authenticator failed for H=(VF7Whwjm) [158.94.208.175]:61124: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:43:07 dovecot_login authenticator failed for H=(llt1U99ZA8) [185.230.124.69]:53677: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 00:44:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:44:27 dovecot_login authenticator failed for H=(37ABaU) [158.94.208.175]:54440: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2026-01-31 00:44:37 dovecot_login authenticator failed for H=([103.56.85.65]) [128.185.227.166]:52868: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.130
country_id: 6252001
description:
Jan 31 00:44:42 sv3 pure-ftpd[3590993]: (?@66.132.153.130) [INFO] New connection from 66.132.153.130


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:44:12 dovecot_login authenticator failed for H=(KCv9gXkwph) [2.58.56.77]:49723: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:44:19 dovecot_login authenticator failed for H=(NgeQ7lbdDu) [185.230.124.69]:62642: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.150.115
country_id: 1819730
description:
2026-01-31 00:44:28 dovecot_login authenticator failed for H=115.150.48.116.static.netvigator.com [116.48.150.115]:61278: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:45:07 dovecot_login authenticator failed for H=(BkwlZOtN0M) [158.94.208.175]:63914: 535 Incorrect authentication data (set_id=contact@modern.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.32
country_id: 6252001
domain: www.xls.mokshana.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/Documentation/assets/ClassDiagrams/Classes/PHPExcel_Reader_Excel2007.cs||User:mokshanacom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:45:16 dovecot_login authenticator failed for H=(J5doBJP97) [185.230.124.69]:64536: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:45:21 dovecot_login authenticator failed for H=(1DlH8DUH) [2.58.56.77]:51452: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:46:01 dovecot_login authenticator failed for H=(P1EIPeVXn) [158.94.208.175]:65030: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:46:06 dovecot_login authenticator failed for H=(intz53Lv0) [185.230.124.69]:49464: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 00:46:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 62.201.255.157
country_id: 99237
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=778095 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:46:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.32
country_id: 6252001
domain: www.xls.mokshana.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/squizlabs/php_codesniffer/scripts/phpcs.bat||User:mokshanacom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:46:25 dovecot_login authenticator failed for H=(ud5N9pV4L) [2.58.56.77]:63580: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:46:29 dovecot_login authenticator failed for H=(BTzQKz) [158.94.208.175]:53408: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:47:28 dovecot_login authenticator failed for H=(Ep5ypO5OF) [158.94.208.175]:60676: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 00:47:32 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account daniel has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2026-01-31 00:47:56 dovecot_plain authenticator failed for H=c-98-227-25-115.hsd1.il.comcast.net (ortherspic) [98.227.25.115]:37888: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:47:14 dovecot_login authenticator failed for H=(21aQZJ) [2.58.56.77]:57264: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.32
country_id: 6252001
domain: www.xls.mokshana.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/Documentation/assets/ClassDiagrams/Classes/PHPExcel_Writer_Serialized.cs||User:mokshanacom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:47:03 dovecot_login authenticator failed for H=(Rrkgyf) [185.230.124.69]:61378: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:47:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.72.176.66
country_id: 2542007
description:
2026-01-31 00:48:47 dovecot_plain authenticator failed for H=(upbox) [105.72.176.66]:48402: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 00:48:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account daniel has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:48:03 dovecot_login authenticator failed for H=(4sznhSa2) [185.230.124.69]:62994: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-31 00:48:04 H=([64.89.160.15]) [64.89.160.15]:57242 F=<drdavid00r5@outlook.com> rejected RCPT <sales@hmz.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:48:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:48:02 dovecot_login authenticator failed for H=(sq1N54qv) [158.94.208.175]:52532: 535 Incorrect authentication data (set_id=enquiry)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.32
country_id: 6252001
domain: www.xls.mokshana.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/Documentation/assets/ClassDiagrams/Classes/PHPExcel_Reader_Excel5.cs||User:mokshanacom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:48:19 dovecot_login authenticator failed for H=(54edD8) [2.58.56.77]:56847: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.32
country_id: 6252001
domain: www.xls.mokshana.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/Documentation/assets/ClassDiagrams/Classes/Worksheet.cs||User:mokshanacom||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 00:49:34 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account daniel has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-31 00:49:44 H=([64.89.160.15]) [64.89.160.15]:61256 F=<essenas@outlook.com> rejected RCPT <mustapa@astlog.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:49:12 dovecot_login authenticator failed for H=(eEE9lpSSZz) [158.94.208.175]:64134: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:49:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:49:25 dovecot_login authenticator failed for H=(0GZWEv) [185.230.124.69]:57947: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/symfony/http-foundation/Tests/Session/Storage/Handler/Fixtures/common.inc||User:visoftcom||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:49:57 dovecot_login authenticator failed for H=(BFdDJtvuBw) [158.94.208.175]:54103: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:49:05 dovecot_login authenticator failed for H=(Y4vWHi) [2.58.56.77]:58970: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:50:11 dovecot_login authenticator failed for H=(oI9Mpd) [2.58.56.77]:60208: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.34.120.78
country_id: 2750405
description:
2026-01-31 00:50:15 dovecot_login authenticator failed for H=78.120.34.34.bc.googleusercontent.com (10.164.0.2) [34.34.120.78]:62290: 535 Incorrect authentication data (set_id=sham@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 00:50:58 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:50:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.32
country_id: 6252001
domain: www.xls.mokshana.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/Documentation/assets/ClassDiagrams/Classes/IWriter.cs||User:mokshanacom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/symfony/translation/Tests/fixtures/resourcebundle/dat/resources.dat||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:50:25 dovecot_login authenticator failed for H=(jcV8W82g) [158.94.208.175]:53021: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:50:17 dovecot_login authenticator failed for H=(sd93cOMNf) [185.230.124.69]:51205: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 00:50:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account daniel has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:51:02 dovecot_login authenticator failed for H=(y3xYuhsL) [185.230.124.69]:53049: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:51:10 dovecot_login authenticator failed for H=(w8pOE2K) [158.94.208.175]:56083: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 00:51:39 dovecot_login authenticator failed for H=(Cj0qAG5) [178.16.54.22]:65534: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 00:51:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:51:26 dovecot_login authenticator failed for H=(WGKJ7NgzD) [2.58.56.77]:50516: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:52:12 dovecot_login authenticator failed for H=(RVfGrE2Uh) [2.58.56.77]:60837: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 00:52:18 dovecot_login authenticator failed for H=(ETXLt5GW) [178.16.54.22]:56691: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 00:52:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:52:11 dovecot_login authenticator failed for H=(gAjKMLmz) [158.94.208.175]:61124: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:52:45 dovecot_login authenticator failed for H=(p6dBt6ol4) [158.94.208.175]:50847: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:52:02 dovecot_login authenticator failed for H=(cFu2OOvfN) [185.230.124.69]:65473: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.163
country_id: 2750405
description:
2026-01-31  0:53:20 2271 [Warning] Aborted connection 2271 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.163' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.146.93.14
country_id: 1668284
description:
2026-01-31 00:53:57 dovecot_login authenticator failed for H=(122-146-93-14.adsl.static.sparqnet.net) [122.146.93.14]:43568: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 00:53:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:53:04 dovecot_login authenticator failed for H=(uWWvtI9) [2.58.56.77]:49196: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.194.18.3
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/tuju7822/public_html/wp-includes/images/wp-login.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:53:22 dovecot_login authenticator failed for H=(qFLEIZ1c) [158.94.208.175]:50139: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:53:08 dovecot_login authenticator failed for H=(LHpyoL) [185.230.124.69]:51979: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 00:53:22 dovecot_login authenticator failed for H=(IXv8IB) [178.16.54.22]:55270: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.134
country_id: 1269750
description:
2026-01-31 00:54:48 dovecot_login authenticator failed for H=([182.79.70.225]) [182.95.230.134]:55520: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:54:59 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 00:54:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.19.64
country_id: 1668284
description:
2026-01-31 00:54:11 dovecot_login authenticator failed for H=111-70-19-64.emome-ip.hinet.net [111.70.19.64]:59917: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:54:15 dovecot_login authenticator failed for H=(ynd5nkG) [185.230.124.69]:58355: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.163
country_id: 2750405
description:
2026-01-31  0:54:51 2344 [Warning] Aborted connection 2344 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.163' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-01-31 00:54:55 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:50134: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 00:54:04 dovecot_login authenticator failed for H=(JeNBfX7j8) [178.16.54.22]:51010: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:54:18 dovecot_login authenticator failed for H=(JXm0P5) [158.94.208.175]:63505: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.96.29.14
country_id: 1269750
description:
2026-01-31 00:54:18 dovecot_login authenticator failed for H=(abts-kk-static-182.209.166.122.airtelbroadband.in) [14.96.29.14]:35872: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.232.191.178
country_id: 1814991
description:
2026-01-31 00:54:21 dovecot_login authenticator failed for H=([123.232.191.178]) [123.232.191.178]:44251: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:54:08 dovecot_login authenticator failed for H=(kltPQnVE) [2.58.56.77]:49969: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2026-01-31 00:54:32 dovecot_login authenticator failed for H=177.162.84.34.bc.googleusercontent.com [34.84.162.177]:52460: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:55:25 dovecot_login authenticator failed for H=(rOOsoYexK) [185.230.124.69]:65472: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:55:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 00:55:10 dovecot_login authenticator failed for H=(EbrqnF9f) [178.16.54.22]:56241: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 00:55:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:55:10 dovecot_login authenticator failed for H=(XVLgu0GM) [158.94.208.175]:61579: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:55:16 dovecot_login authenticator failed for H=(2I0YjY) [2.58.56.77]:59709: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:55:23 dovecot_login authenticator failed for H=(hX6KYaHo) [158.94.208.175]:56707: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 20.212.211.10
country_id: 1880251
domain: mckd.com.my
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/WordPressCore/||WPU:||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:56:24 dovecot_login authenticator failed for H=(Ve1t3nWQTM) [2.58.56.77]:58971: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.154
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/css/main.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 52.80.164.128
country_id: 1814991
domain: www.oxbold.com
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 13; PFFM10 Build/TP1A.220905.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.181 Mobile Safari/537.36 aweme_250000 JsSdk/1.0 NetType/WIFI Channel/31725782a AppName/aweme app_version/25.0.0 ByteLocale/zh-CN Region/CN AppSkin/white AppTheme/light BULLET/1 BytedanceWebview/d8a21c6 TTWebView/0881130048402||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.124.76.171
country_id: 3469034
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/company/introduction/showroom/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 113.211.120.79
country_id: 1733045
domain: www.oxbold.com
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 doubao_12.0.0 JsSdk/2.0 NetType/MOBILE Channel/App Store Rifle_12.0.0 WKWebView/1 Bullet/1 doubao/12.0.0 BulletTag/9C5CC2EE-3A83-4505-8818-095CD73919C2 BytedanceWebview/d8a21c6 aid/482431 argus_biz/anniex FalconTag/F998E724-3A33-4DFC-A50E-674193D9F3F0||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:56:06 dovecot_login authenticator failed for H=(2EJCEKS) [158.94.208.175]:50933: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-31 00:56:15 H=(localhost.localdomain) [78.153.140.207]:51192 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.214
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/css/common.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:56:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:56:15 dovecot_login authenticator failed for H=(oizcXycq) [185.230.124.69]:52470: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.237.119.118
country_id: 6252001
description:
2026-01-31 00:57:41 dovecot_login authenticator failed for H=118-119-237-24.gci.net [24.237.119.118]:40724: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:57:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:57:08 dovecot_login authenticator failed for H=(vsbHYq) [2.58.56.77]:49161: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-31 00:57:49 H=(localhost.localdomain) [78.153.140.207]:50172 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 00:57:57 dovecot_login authenticator failed for H=(pbhq3k) [178.16.54.22]:56526: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:57:03 dovecot_login authenticator failed for H=(audcaHDY7) [185.230.124.69]:54326: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:57:02 dovecot_login authenticator failed for H=(BdWwY87pg) [158.94.208.175]:53319: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:58:19 dovecot_login authenticator failed for H=(ummjhnM) [2.58.56.77]:63570: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:58:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.215.1.201
country_id: 2635167
description:
2026-01-31 00:58:04 dovecot_login authenticator failed for H=([88.215.1.201]) [88.215.1.201]:44077: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/products.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-01-31 00:58:18 dovecot_login authenticator failed for H=(azteca-comunicaciones.com) [201.46.124.0]:1516: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:58:03 dovecot_login authenticator failed for H=(VVhBMzzDqU) [158.94.208.175]:52129: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 00:58:29 dovecot_login authenticator failed for H=(RS0bdCd) [178.16.54.22]:59517: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:58:15 dovecot_login authenticator failed for H=(yDol0YCX) [185.230.124.69]:49290: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:58:40 dovecot_login authenticator failed for H=(XKNCAUw) [185.230.124.69]:59737: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.6.31
country_id: 1880251
description:
2026-01-31 00:58:11 dovecot_login authenticator failed for H=(31.6.245.49.unknown.m1.com.sg) [49.245.6.31]:42590: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:59:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 49.12.5.146
country_id: 2921044
domain: feliogroup.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/128.0.0.0 Safari/537.36||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:59:03 dovecot_login authenticator failed for H=(oebvFR) [2.58.56.77]:61221: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 00:59:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:59:13 dovecot_login authenticator failed for H=(WVPjEBIU7r) [158.94.208.175]:56782: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 00:59:23 dovecot_login authenticator failed for H=(gfQYodPu) [69.5.189.21]:65095: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/symfony/translation/Tests/fixtures/resourcebundle/corrupted/resources.dat||User:visoftcom||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 203.23.179.35
country_id: 2921044
description:
[2026-01-31 00:59:39 +0800] info [webmaild] 203.23.179.35 - project@tujusetia.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:59:05 dovecot_login authenticator failed for H=(dhCrz3blo3) [185.230.124.69]:49948: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.141.143.58
country_id: 1835841
description:
2026-01-31 00:59:49 dovecot_login authenticator failed for H=([115.141.143.58]) [115.141.143.58]:59241: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.177.9.119
country_id: 3865483
description:
2026-01-31 01:00:01 dovecot_login authenticator failed for H=(181-177-9-119.fiberway.com.ar) [181.177.9.119]:39718: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.127.217
country_id: 1512440
description:
2026-01-31 01:00:44 dovecot_login authenticator failed for H=([213.230.127.217]) [213.230.127.217]:60468: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.163.159.21
country_id: 2017370
description:
2026-01-31 01:00:52 dovecot_login authenticator failed for H=([46.163.159.21]) [46.163.159.21]:41874: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:00:02 dovecot_login authenticator failed for H=(4Zz1kfQM8) [178.16.54.22]:55339: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 01:00:10 dovecot_login authenticator failed for H=(gqdX2nKBe) [69.5.189.21]:56414: 535 Incorrect authentication data (set_id=myloo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:00:13 dovecot_login authenticator failed for H=(stqIZS) [158.94.208.175]:52503: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:00:15 dovecot_login authenticator failed for H=(ysai2NRt) [2.58.56.77]:62041: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:00:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:00:20 dovecot_login authenticator failed for H=(LNeiaoZ35n) [185.230.124.69]:57263: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.85
country_id: 337996
description:
2026-01-31 01:00:40 dovecot_login authenticator failed for H=([196.188.187.85]) [196.188.187.85]:47154: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:01:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account boolan@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:01:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 01:01:20 dovecot_login authenticator failed for H=(ygNlbst) [69.5.189.21]:52074: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:01:21 dovecot_login authenticator failed for H=(KsUDNOPFYD) [2.58.56.77]:52213: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.67.146
country_id: 2017370
description:
2026-01-31 01:01:01 dovecot_login authenticator failed for H=([31.173.67.146]) [31.173.67.146]:55608: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:01:03 dovecot_login authenticator failed for H=(IB7wdVZx) [185.230.124.69]:49175: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:01:07 dovecot_login authenticator failed for H=(18eYJb) [178.16.54.22]:59063: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:01:01 dovecot_login authenticator failed for H=(tTjq6X3r) [158.94.208.175]:62552: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:01:34 dovecot_login authenticator failed for H=(yT0KBghdw) [185.230.124.69]:53282: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:02:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account boolan@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:02:05 dovecot_login authenticator failed for H=(FVWsy2kWP) [2.58.56.77]:58111: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 01:02:08 dovecot_login authenticator failed for H=(mD7tQ7) [69.5.189.21]:60047: 535 Incorrect authentication data (set_id=myloo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:02:09 dovecot_login authenticator failed for H=(nLZk2V) [158.94.208.175]:60904: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:02:19 dovecot_login authenticator failed for H=(5Z3vMA) [185.230.124.69]:54414: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.102
country_id: 1269750
description:
2026-01-31 01:02:37 dovecot_login authenticator failed for H=([27.123.104.102]) [27.123.104.102]:33674: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:02:50 dovecot_login authenticator failed for H=(NEJmYfrUXi) [178.16.54.22]:49739: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.193.149
country_id: 1643084
description:
2026-01-31 01:02:04 dovecot_login authenticator failed for H=([103.186.193.149]) [103.186.193.149]:59650: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/photos/contact.php||SC:/home/indfinitydesign/public_html/img/photos/contact.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.13.99.66
country_id: 1814991
description:
2026-01-31 01:02:20 dovecot_login authenticator failed for H=([210.13.99.68]) [210.13.99.66]:3735: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:02:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.72.74.130
country_id: 2017370
description:
2026-01-31 01:02:53 dovecot_login authenticator failed for H=([188.72.74.130]) [188.72.74.130]:51142: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.153.127.4
country_id: 3625428
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/hamcrest/hamcrest-php/hamcrest/Hamcrest/Internal HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.82.52.127
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/hamcrest/hamcrest-php/hamcrest/Hamcrest/Internal/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:03:09 dovecot_login authenticator failed for H=(KFyHbOMlC) [185.230.124.69]:62237: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.80
country_id: 2782113
description:
2026-01-31 01:03:00 dovecot_login authenticator failed for H=(ADMIN) [156.146.60.80]:7846: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:03:05 dovecot_login authenticator failed for H=(JgQMh0IBvQ) [2.58.56.77]:53411: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:03:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:03:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account boolan@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:03:12 dovecot_login authenticator failed for H=(sLCSZJ) [158.94.208.175]:49417: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 01:03:17 dovecot_login authenticator failed for H=(no7wqBeq) [69.5.189.21]:61387: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:04:04 dovecot_login authenticator failed for H=(0nfVxyRFl) [185.230.124.69]:56192: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:04:55 dovecot_login authenticator failed for H=(69hd5FB) [178.16.54.22]:63072: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 01:04:05 dovecot_login authenticator failed for H=(QCWZjLz) [69.5.189.21]:53139: 535 Incorrect authentication data (set_id=myloo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.168.104.170
country_id: 1814991
description:
2026-01-31 01:04:27 dovecot_login authenticator failed for H=(pc170.zz.ha.cn) [61.168.104.170]:57378: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:04:30 dovecot_login authenticator failed for H=(QKyEdqotzs) [185.230.124.69]:51759: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:04:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account boolan@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:04:10 dovecot_login authenticator failed for H=(pyPFZtJ) [2.58.56.77]:49876: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:04:23 dovecot_login authenticator failed for H=(GqtvrtHpw) [158.94.208.175]:56706: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.202
country_id: 1269750
description:
2026-01-31 01:04:42 dovecot_login authenticator failed for H=([128.185.247.100]) [182.95.222.202]:47894: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.42.67.114
country_id: 1814991
description:
2026-01-31 01:04:56 dovecot_login authenticator failed for H=([36.42.67.114]) [36.42.67.114]:48920: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:05:13 dovecot_login authenticator failed for H=(d3Jxa4) [185.230.124.69]:51949: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:05:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account boolan@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:05:18 dovecot_login authenticator failed for H=(kRBQv2UZ) [158.94.208.175]:61537: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:05:22 dovecot_login authenticator failed for H=(sD47cH) [2.58.56.77]:54163: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 01:05:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:05:23 dovecot_login authenticator failed for H=(oOYYtfJf) [178.16.54.22]:54311: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.85.14.208
country_id: 6252001
description:
2026-01-31 01:05:37 dovecot_login authenticator failed for H=([107.85.14.208]) [107.85.14.208]:37061: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.125
country_id: 6252001
description:
2026-01-31  1:05:40 2801 [Warning] Aborted connection 2801 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.125' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:06:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 01:06:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:06:07 dovecot_login authenticator failed for H=(B7CwHmG) [2.58.56.77]:61334: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:06:08 dovecot_login authenticator failed for H=(RVsbvnlD) [158.94.208.175]:51750: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:06:06 dovecot_login authenticator failed for H=(qufK3gof) [185.230.124.69]:51659: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:06:10 dovecot_login authenticator failed for H=(m2T8PiR) [178.16.54.22]:53673: 535 Incorrect authentication data (set_id=rosliza)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/symfony/translation/Loader/schema/dic/xliff-core/xliff-core-1.2-strict.xsd||User:visoftcom||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:06:36 dovecot_login authenticator failed for H=(GAUoVbP) [185.230.124.69]:49773: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.23.168
country_id: 1814991
description:
2026-01-31 01:07:49 dovecot_login authenticator failed for H=([120.238.23.168]) [120.238.23.168]:36205: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:07:02 dovecot_login authenticator failed for H=(HxUVVac21U) [185.230.124.69]:59396: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 01:07:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:07:21 dovecot_login authenticator failed for H=(o2mEefxKj) [158.94.208.175]:64816: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.92.202
country_id: 1269750
description:
2026-01-31 01:07:58 dovecot_login authenticator failed for H=([125.17.215.121]) [27.123.92.202]:43252: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:07:16 dovecot_login authenticator failed for H=(nGZnIUW9Ys) [2.58.56.77]:55598: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:07:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:07:08 dovecot_login authenticator failed for H=(K4BLlRk0) [178.16.54.22]:54597: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:08:03 dovecot_login authenticator failed for H=(VxSs7H) [178.16.54.22]:54026: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:08:08 dovecot_login authenticator failed for H=(YtDccKP5Ts) [185.230.124.69]:58820: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:08:39 dovecot_login authenticator failed for H=(FZQSW4LS8v) [185.230.124.69]:59758: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:08:02 dovecot_login authenticator failed for H=(jw6e1y) [2.58.56.77]:50083: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 01:08:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:08:10 dovecot_login authenticator failed for H=(30sGDEW1) [158.94.208.175]:54004: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:08:00 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:08:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:09:07 dovecot_login authenticator failed for H=(Vt1FHobW) [2.58.56.77]:55891: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.39.227.34
country_id: 1861060
description:
2026-01-31 01:09:59 dovecot_login authenticator failed for H=p430035-obmd01.tokyo.ocn.ne.jp [60.39.227.34]:48544: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:09:07 dovecot_login authenticator failed for H=(cjo8L35l9t) [178.16.54.22]:57911: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:09:15 dovecot_login authenticator failed for H=(wE7zmou2hK) [158.94.208.175]:60816: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 102.212.163.22
country_id: 2328926
domain: working.magsoft.com.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.71||T:APACHE||RA:102.212.163.22||TA:102.212.163.22||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:09:04 dovecot_login authenticator failed for H=(DeXffoszIg) [185.230.124.69]:63044: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:09:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 01:09:37 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:10:17 dovecot_login authenticator failed for H=(sFk56Ytm) [178.16.54.22]:58028: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:10:22 dovecot_login authenticator failed for H=(4Einf6pE) [158.94.208.175]:61039: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.161
country_id: 2750405
description:
2026-01-31  1:10:25 3133 [Warning] Aborted connection 3133 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.161' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.137.250
country_id: 1269750
description:
2026-01-31 01:10:41 dovecot_login authenticator failed for H=([203.193.137.250]) [203.193.137.250]:55775: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:10:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account boolan@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2026-01-31 01:10:31 dovecot_login authenticator failed for H=(c-50-188-204-213.unallocated.comcastbusiness.net) [50.188.204.213]:51955: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:10:16 dovecot_login authenticator failed for H=(cXME9Pi2) [185.230.124.69]:62493: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:10:15 dovecot_login authenticator failed for H=(B59HYL) [2.58.56.77]:63678: 535 Incorrect authentication data (set_id=mustapa)


plugin: modsec
rule: 77317988
name: IM360 WAF: Block access to quarantined files
abuser: 188.166.226.12
country_id: 1880251
domain: agsaintifik.com.my
description:
IM360 WAF: Block access to quarantined files||RSV:7.71||T:APACHE||MVN:REQUEST_URI||MV:/.quarantine/alfacgiapi/perl.alfa||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.47.2
country_id: 1269750
description:
2026-01-31 01:11:06 dovecot_login authenticator failed for H=([122.184.143.81]) [182.95.47.2]:43504: 535 Incorrect authentication data (set_id=aziz)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.197.219.140
country_id: 3996063
domain: www.ahfengineering.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahfengineering.com/cgi-bin HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:11:04 dovecot_login authenticator failed for H=(m2Wbzs) [185.230.124.69]:65034: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2026-01-31 01:11:05 dovecot_login authenticator failed for H=187-126-105-42.user.vtal.net.br [187.126.105.42]:49309: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:11:23 dovecot_login authenticator failed for H=(mSTcSgo4) [2.58.56.77]:62850: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:11:01 dovecot_login authenticator failed for H=(Gf8hO7) [185.230.124.69]:59639: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:11:11 dovecot_login authenticator failed for H=(eO1J87Ezh) [178.16.54.22]:60889: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.16.83.159
country_id: 2017370
description:
2026-01-31 01:11:13 dovecot_login authenticator failed for H=(5x16x83x159.dynamic.spb.ertelecom.ru) [5.16.83.159]:52796: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:11:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:11:06 dovecot_login authenticator failed for H=(mjTeTvpnJ9) [158.94.208.175]:60145: 535 Incorrect authentication data (set_id=felioit)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 176.119.140.20
country_id: 2017370
domain: www.oxbold.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:oxboldc||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.161
country_id: 2750405
description:
2026-01-31  1:11:17 3199 [Warning] Aborted connection 3199 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.161' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:12:08 dovecot_login authenticator failed for H=(Uuc6XdHR8P) [185.230.124.69]:54530: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:12:14 dovecot_login authenticator failed for H=(Tzu5L9K1w) [158.94.208.175]:62360: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 95.217.176.173
country_id: 660013
domain: feliogroup.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/about.php||SC:/home2/feliogroupcom/public_html/images/about.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:12:23 dovecot_login authenticator failed for H=(0GX6YdhLG) [178.16.54.22]:62267: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-31 01:12:25 H=([64.89.160.15]) [64.89.160.15]:56124 F=<essenas@outlook.com> rejected RCPT <sales@hmz.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:12:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account boolan@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:12:28 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:12:09 dovecot_login authenticator failed for H=(PPLi3pr6) [2.58.56.77]:53947: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:13:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:13:21 dovecot_login authenticator failed for H=(V9NpasQt) [178.16.54.22]:64413: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.210.129.89
country_id: 1861060
domain: mail.hishammuddin.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/cabecom/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:13:14 dovecot_login authenticator failed for H=(mwVaOYc) [2.58.56.77]:52577: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:13:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:13:11 dovecot_login authenticator failed for H=(YLb5yPew) [185.230.124.69]:58079: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:13:20 dovecot_login authenticator failed for H=(mGsFNeR) [158.94.208.175]:61903: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:14:05 dovecot_login authenticator failed for H=(WzYSN1Q) [158.94.208.175]:59034: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:14:10 dovecot_login authenticator failed for H=(pJ0t1kZ921) [185.230.124.69]:62410: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:14:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account boolan@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:14:03 dovecot_login authenticator failed for H=(yQuNp182e) [2.58.56.77]:60127: 535 Incorrect authentication data (set_id=mustapa)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.223.150.246
country_id: 2963597
domain: cloudhost.magsoft.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/cloudhostmagsoft/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:14:22 dovecot_login authenticator failed for H=(xFhafaV) [178.16.54.22]:64080: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:14:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:14:05 dovecot_login authenticator failed for H=(4ALdWrOZk) [185.230.124.69]:54450: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:15:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.161
country_id: 2750405
description:
2026-01-31  1:16:00 3727 [Warning] Aborted connection 3727 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.161' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:15:08 dovecot_login authenticator failed for H=(Lym7yGKC) [2.58.56.77]:58148: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:15:11 dovecot_login authenticator failed for H=(KodDxUA) [178.16.54.22]:58628: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.49.97.15
country_id: 6252001
description:
2026-01-31 01:15:45 dovecot_login authenticator failed for H=(64-49-97-15.protekweb.com) [64.49.97.15]:49988: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.223.150.246
country_id: 2963597
domain: cloudhost.magsoft.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/index.php||SC:/home2/cloudhostmagsoft/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.182.130
country_id: 1269750
description:
2026-01-31 01:15:54 dovecot_login authenticator failed for H=(mail1.i-megh.com) [182.95.182.130]:43858: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:15:03 dovecot_login authenticator failed for H=(OhpnDpe1E) [158.94.208.175]:56246: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:15:04 dovecot_login authenticator failed for H=(yo4tvM6) [185.230.124.69]:60384: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.185.18
country_id: 1269750
description:
2026-01-31 01:16:33 dovecot_login authenticator failed for H=([182.95.87.179]) [122.185.185.18]:54094: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.17.213.162
country_id: 1814991
description:
2026-01-31 01:16:47 dovecot_login authenticator failed for H=([111.17.213.162]) [111.17.213.162]:52909: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:17:00 dovecot_login authenticator failed for H=(jkswHHm) [185.230.124.69]:58127: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:16:06 dovecot_login authenticator failed for H=(bfNUSQ) [178.16.54.22]:60386: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:16:13 dovecot_login authenticator failed for H=(oQc7tN) [2.58.56.77]:61318: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:16:15 dovecot_login authenticator failed for H=(pN3rRcs) [185.230.124.69]:57216: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:16:02 dovecot_login authenticator failed for H=(w9JEGbAF) [158.94.208.175]:50119: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:16:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.56.206.142
country_id: 953987
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/DependencyInjection/AddAnnotatedClassesToCachePass.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:17:04 dovecot_login authenticator failed for H=(8soRtS) [158.94.208.175]:61936: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:17:08 dovecot_login authenticator failed for H=(gcJAwZLU) [185.230.124.69]:52840: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.77.115
country_id: 1269750
description:
2026-01-31 01:17:23 dovecot_login authenticator failed for H=([103.220.16.51]) [117.247.77.115]:60882: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.22.230.116
country_id: 587116
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/CacheClearer/Psr6CacheClearer.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:17:12 dovecot_login authenticator failed for H=(oPtWOgk8) [178.16.54.22]:51430: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:17:15 dovecot_login authenticator failed for H=(90o8BXH) [2.58.56.77]:51081: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.89.38
country_id: 1269750
description:
2026-01-31 01:17:41 dovecot_login authenticator failed for H=([203.147.89.38]) [203.147.89.38]:38576: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.93.62.202
country_id: 2017370
description:
2026-01-31 01:18:23 dovecot_login authenticator failed for H=80-93-62-202.vps-ptr.clients.spaceweb.ru [80.93.62.202]:38810: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2026-01-31 01:18:16 dovecot_login authenticator failed for H=([182.95.215.9]) [182.95.227.70]:43074: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:18:20 dovecot_login authenticator failed for H=(0Fe9NDD) [2.58.56.77]:54539: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:18:02 dovecot_login authenticator failed for H=(pp7Wv5) [158.94.208.175]:52560: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:18:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:18:10 dovecot_login authenticator failed for H=(BqfcxAg) [178.16.54.22]:62913: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:18:17 dovecot_login authenticator failed for H=(0r4YY33) [185.230.124.69]:50991: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:19:03 dovecot_login authenticator failed for H=(eLLhGpIIoq) [185.230.124.69]:61260: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2026-01-31 01:19:21 dovecot_login authenticator failed for H=([125.20.249.39]) [128.185.214.78]:54874: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:19:46 dovecot_login authenticator failed for H=(Z18DFLG78X) [185.230.124.69]:52632: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:19:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account boolan@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:19:09 dovecot_login authenticator failed for H=(JVFBiMAi) [178.16.54.22]:60379: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.134.139.170
country_id: 6251999
description:
2026-01-31 01:19:57 dovecot_login authenticator failed for H=([207.134.139.173]) [207.134.139.170]:64423: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.13.99.66
country_id: 1814991
description:
2026-01-31 01:19:10 dovecot_login authenticator failed for H=([210.13.99.68]) [210.13.99.66]:3179: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:19:21 dovecot_login authenticator failed for H=(Sk0gHB) [2.58.56.77]:56064: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:19:02 dovecot_login authenticator failed for H=(v8OBw0n3) [158.94.208.175]:62133: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:20:08 dovecot_login authenticator failed for H=(y1SdBn) [158.94.208.175]:53527: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:20:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.111.147.32
country_id: 2017370
description:
2026-01-31 01:20:27 dovecot_login authenticator failed for H=(ip32-147-111-78.pppoe.ivanovo.stream.ru) [78.111.147.32]:60514: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.172.80.110
country_id: 1269750
domain: smartcable.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:45503.smartcable.com.my||ServerName:smartcable.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8e0d6de3b3c62e1ea665b86e5136b301d956ac43||Title:0xd9db38be||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.129.90.215
country_id: 2921044
description:
2026-01-31 01:20:18 dovecot_login authenticator failed for H=ns3241969.ip-57-129-90.eu [57.129.90.215]:44954: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2026-01-31 01:20:18 dovecot_login authenticator failed for H=063.40.246.220.static.netvigator.com [220.246.40.63]:48718: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:20:10 dovecot_login authenticator failed for H=(SWHlqbq) [2.58.56.77]:56181: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:20:13 dovecot_login authenticator failed for H=(2OGKvSFR6N) [185.230.124.69]:61560: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.41
country_id: 690791
description:
2026-01-31 01:20:50 H=([45.144.212.41]) [45.144.212.41]:64714 F=<ash.zhang@ugslogistics.com> rejected RCPT <shipping@cordage.com.my>: SPF: 45.144.212.41 is not allowed to send mail from ugslogistics.com


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-01-31 01:21:33 +0800] info [cpaneld] 185.204.54.153 - mssa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mssa (has_cpuser_file failed)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:21:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account boolan@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:21:08 dovecot_login authenticator failed for H=(uH2rK1d1cA) [185.230.124.69]:50703: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/demos/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:21:11 dovecot_login authenticator failed for H=(S3ep5B5A) [158.94.208.175]:50261: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:21:20 dovecot_login authenticator failed for H=(JcvljF4M8z) [2.58.56.77]:51440: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:21:07 dovecot_login authenticator failed for H=(r18Ejht3LF) [178.16.54.22]:50008: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:22:38 dovecot_login authenticator failed for H=(mHXlypzD) [158.94.208.175]:63053: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:22:50 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:22:02 dovecot_login authenticator failed for H=(xJm5hQB) [185.230.124.69]:62741: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:22:06 dovecot_login authenticator failed for H=(NIuZXjS) [2.58.56.77]:56428: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:22:12 dovecot_login authenticator failed for H=(vUBdDSPg) [178.16.54.22]:57656: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:22:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account boolan@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:22:54 dovecot_login authenticator failed for H=(VPzfXQpr0u) [185.230.124.69]:59540: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:23:11 dovecot_login authenticator failed for H=(ntPCLzj) [2.58.56.77]:55561: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:23:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account boolan@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.219.24.104
country_id: 1269750
domain: ajresorts.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/ajresortscom/public_html/wp-includes||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:23:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:23:21 dovecot_login authenticator failed for H=(TH6KSFkb) [185.230.124.69]:57586: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:23:10 dovecot_login authenticator failed for H=(IWKjWY) [158.94.208.175]:55600: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:23:24 dovecot_login authenticator failed for H=(YqEYG2) [178.16.54.22]:61680: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:24:02 dovecot_login authenticator failed for H=(pLyft9f7) [158.94.208.175]:55678: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:24:08 dovecot_login authenticator failed for H=(cnMj7GA) [185.230.124.69]:65414: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:24:04 dovecot_login authenticator failed for H=(iW37VISw) [2.58.56.77]:55517: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 01:24:18 dovecot_login authenticator failed for H=(nMop000eL) [193.26.115.228]:63531: 535 Incorrect authentication data (set_id=hafizi)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:24:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:24:31 dovecot_login authenticator failed for H=(XGfA8Lofv) [178.16.54.22]:57530: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.1.110.201
country_id: 1562822
description:
2026-01-31 01:24:54 dovecot_login authenticator failed for H=([42.1.110.201]) [42.1.110.201]:46074: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:25:20 dovecot_login authenticator failed for H=(caotlNnv) [158.94.208.175]:49636: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:25:17 dovecot_login authenticator failed for H=(oS5Z5kbpAn) [2.58.56.77]:60755: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:25:18 dovecot_login authenticator failed for H=(yqhOXji) [185.230.124.69]:57781: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:25:43 dovecot_login authenticator failed for H=(Li8XZp2jh) [185.230.124.69]:49585: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.187.228.165
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=794941 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:25:03 dovecot_login authenticator failed for H=(PX62K7SK) [178.16.54.22]:55456: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.28.253.144
country_id: 690791
description:
2026-01-31 01:25:08 dovecot_login authenticator failed for H=(undefined.sevstar.net) [31.28.253.144]:34214: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:25:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:26:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.210.129.89
country_id: 1861060
domain: imax.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/imaxcom/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:26:20 dovecot_login authenticator failed for H=(f0PbNNkV) [158.94.208.175]:64698: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:26:56 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:26:06 dovecot_login authenticator failed for H=(Ui9xvME) [2.58.56.77]:63000: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:26:13 dovecot_login authenticator failed for H=(HWkvuo) [178.16.54.22]:57827: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.158.148
country_id: 1814991
description:
2026-01-31 01:27:01 dovecot_login authenticator failed for H=([60.166.158.148]) [60.166.158.148]:60345: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.56.144.131
country_id: 1269750
domain: solidfence.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:28724.solidfence.com.my||ServerName:solidfence.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7c2ca50d2f5ed3ae6493f3f5412e2cb7d3e95fac||Title:0x09d29b0a||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/symfony/finder/Tests/Fixtures/A/a.dat||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:26:08 dovecot_login authenticator failed for H=(86LFzP) [185.230.124.69]:63583: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:27:23 dovecot_login authenticator failed for H=(IwoH3RHWdS) [2.58.56.77]:63419: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.66.2.184
country_id: 390903
description:
2026-01-31 01:27:24 dovecot_login authenticator failed for H=orz58h.static.otenet.gr [94.66.2.184]:52820: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:27:06 dovecot_login authenticator failed for H=(7jPJXkSl8) [158.94.208.175]:51266: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:27:19 dovecot_login authenticator failed for H=(MNhiy6) [185.230.124.69]:51562: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:27:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:27:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.126.39
country_id: 3703430
description:
2026-01-31 01:27:54 dovecot_login authenticator failed for H=(ADMIN) [91.90.126.39]:38425: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:27:14 dovecot_login authenticator failed for H=(D8Gay4vQ) [178.16.54.22]:53704: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:28:32 dovecot_login authenticator failed for H=(TYtNE4x7) [185.230.124.69]:49372: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.210
country_id: 99237
description:
2026-01-31 01:28:43 dovecot_plain authenticator failed for H=(argenepa) [65.20.191.210]:35844: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:28:02 dovecot_login authenticator failed for H=(4fxR2pt) [158.94.208.175]:55057: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:28:03 dovecot_login authenticator failed for H=(Ejn2VVlXi0) [178.16.54.22]:55744: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:28:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:28:07 dovecot_login authenticator failed for H=(J5RVGFeQj) [185.230.124.69]:49530: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:28:11 dovecot_login authenticator failed for H=(6b4zG0V) [2.58.56.77]:53478: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 62.212.54.174
country_id: 614540
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/afraid/10/112/1031803 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:29:16 dovecot_login authenticator failed for H=(Rm63Dn9Lc) [185.230.124.69]:50831: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/symfony/translation/Loader/schema/dic/xliff-core/xliff-core-2.0.xsd||User:visoftcom||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:29:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account boolan@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 45.142.99.14
country_id: 6252001
domain: www.box.com.my
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 14; RMX3521 Build/UKQ1.230924.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/124.0.6367.123 Mobile Safari/537.36 trill_340506 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/trill app_version/34.5.6 ByteLocale/id-ID ByteFullLocale/id-ID Region/ID AppId/1180 Spark/1.5.4.10-bugfix AppVersion/34.5.6 BytedanceWebview/d8a21c6||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:29:04 dovecot_login authenticator failed for H=(VmM3JEecJy) [158.94.208.175]:55742: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:29:07 dovecot_login authenticator failed for H=(H7TffV) [178.16.54.22]:61050: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:29:22 dovecot_login authenticator failed for H=(QSq8b10gL) [2.58.56.77]:64059: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:30:14 dovecot_login authenticator failed for H=(vc1hLVkO) [158.94.208.175]:50372: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:30:09 dovecot_login authenticator failed for H=(sgu684h) [2.58.56.77]:55848: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:30:44 dovecot_login authenticator failed for H=(QxMaisTUf) [178.16.54.22]:57398: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:30:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account boolan@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:30:13 dovecot_login authenticator failed for H=(5ozQsU7X) [185.230.124.69]:61662: 535 Incorrect authentication data (set_id=recruitment)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:31:24 dovecot_login authenticator failed for H=(9I8mPXDU5) [185.230.124.69]:57729: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:31:01 dovecot_login authenticator failed for H=(S4mOUMKcN3) [178.16.54.22]:54025: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:31:22 dovecot_login authenticator failed for H=(7t8Zas9) [2.58.56.77]:53893: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:31:06 dovecot_login authenticator failed for H=(ZUNXhPiKZ) [158.94.208.175]:57168: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:31:05 dovecot_login authenticator failed for H=(5kcCb4ct9a) [185.230.124.69]:63481: 535 Incorrect authentication data (set_id=recruitment)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:31:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account boolan@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:32:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:32:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account boolan@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:32:24 dovecot_login authenticator failed for H=(sSY6S5p) [178.16.54.22]:53563: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:32:02 dovecot_login authenticator failed for H=(b71owgjHE) [158.94.208.175]:55296: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:32:05 dovecot_login authenticator failed for H=(4iwMeGs7L) [2.58.56.77]:59865: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:32:09 dovecot_login authenticator failed for H=(dJ8zLS) [185.230.124.69]:63651: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:33:10 dovecot_login authenticator failed for H=(a1LHBSi) [158.94.208.175]:60418: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:33:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:33:15 dovecot_login authenticator failed for H=(FTYUxI) [2.58.56.77]:58491: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:33:01 dovecot_login authenticator failed for H=(qXpwzpvj5R) [185.230.124.69]:56608: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:33:23 dovecot_login authenticator failed for H=(sIOf7xnF) [178.16.54.22]:64777: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:34:21 dovecot_login authenticator failed for H=(9rOePpxT) [185.230.124.69]:49519: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.132.97.76
country_id: 2264397
description:
2026-01-31 01:34:24 dovecot_login authenticator failed for H=a94-132-97-76.cpe.netcabo.pt [94.132.97.76]:57490: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:34:35 dovecot_login authenticator failed for H=(HotIqQ) [178.16.54.22]:55729: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:34:16 dovecot_login authenticator failed for H=(Q7YlasG) [2.58.56.77]:55972: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.170.15
country_id: 3175395
description:
2026-01-31 01:34:52 dovecot_plain authenticator failed for H=([100.64.100.6]) [2.57.170.15]:6094: 535 Incorrect authentication data (set_id=hrd@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:34:48 dovecot_login authenticator failed for H=(KVz2j0jxZ) [158.94.208.175]:62926: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:34:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.113.253
country_id: 2510769
description:
2026-01-31 01:34:16 dovecot_login authenticator failed for H=(253.pool90-160-113.dynamic.orange.es) [90.160.113.253]:60763: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:34:20 dovecot_login authenticator failed for H=(00Y47d) [185.230.124.69]:60645: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:35:36 dovecot_login authenticator failed for H=(Jl9fRZNro) [178.16.54.138]:61783: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:35:00 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.170.15
country_id: 3175395
description:
2026-01-31 01:35:05 dovecot_plain authenticator failed for H=([100.64.100.6]) [2.57.170.15]:61843: 535 Incorrect authentication data (set_id=hrd@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:35:09 dovecot_login authenticator failed for H=(4Yge2TMN) [178.16.54.22]:50329: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: modsec
rule: 77896900
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 174.138.27.41
country_id: 1880251
domain: agpc.org.my
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wpadminerlzp||User:agpcorg||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:35:58 dovecot_login authenticator failed for H=(gQGKHZZ) [158.94.208.175]:64420: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:35:13 dovecot_login authenticator failed for H=(0jf0RwlJ) [185.230.124.69]:57577: 535 Incorrect authentication data (set_id=boolan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:35:02 dovecot_login authenticator failed for H=(7ZYucyRE) [2.58.56.77]:59120: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 174.138.27.41
country_id: 1880251
domain: agpc.org.my
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wadminw||User:agpcorg||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:36:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:36:07 dovecot_login authenticator failed for H=(n89Qra4pDQ) [2.58.56.77]:59619: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:36:57 dovecot_login authenticator failed for H=(pOtLQjkO0) [185.230.124.69]:60121: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:36:04 dovecot_login authenticator failed for H=(ZoqpIacX) [185.230.124.69]:49397: 535 Incorrect authentication data (set_id=boolan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:36:08 dovecot_login authenticator failed for H=(9H1nX6x6Jg) [178.16.54.22]:58668: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.62.173.90
country_id: 1814991
description:
2026-01-31 01:36:12 dovecot_login authenticator failed for H=([111.62.173.90]) [111.62.173.90]:59542: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-31 01:36:28 dovecot_login authenticator failed for H=(www.safecleen.com) [58.49.113.138]:17876: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:36:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:36:06 dovecot_login authenticator failed for H=(k4Qgrri) [158.94.208.175]:58738: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:36:22 dovecot_login authenticator failed for H=(62NYlTW) [178.16.54.138]:58527: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:37:06 dovecot_login authenticator failed for H=(7bauC1YRF) [158.94.208.175]:58192: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:37:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:37:02 dovecot_login authenticator failed for H=(ndoPWr) [185.230.124.69]:51918: 535 Incorrect authentication data (set_id=celine@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:37:05 dovecot_login authenticator failed for H=(68qMRoX3Ag) [178.16.54.22]:62130: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 212.107.27.168
country_id: 2921044
domain: www.oxbold.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.bak||User:oxboldc||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:37:13 dovecot_login authenticator failed for H=(mQEvej67o) [2.58.56.77]:57656: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:37:29 dovecot_login authenticator failed for H=(oBJ49L7O3V) [178.16.54.138]:59103: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:38:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:38:01 dovecot_login authenticator failed for H=(ACmYi7) [178.16.54.138]:56789: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:38:07 dovecot_login authenticator failed for H=(WMFYgpJu0) [178.16.54.22]:52645: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:38:08 dovecot_login authenticator failed for H=(Nq0laC) [158.94.208.175]:63598: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:38:12 dovecot_login authenticator failed for H=(PWhjXd6bda) [185.230.124.69]:50960: 535 Incorrect authentication data (set_id=boolan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:39:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:39:31 dovecot_login authenticator failed for H=(QipHXN) [178.16.54.22]:55755: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 98.95.177.220
country_id: 6252001
domain: www.dsc-expat.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 167.71.22.62
country_id: 6252001
description:
2026-01-31  1:39:09 4535 [Warning] Aborted connection 4535 to db: 'unconnected' user: 'unauthenticated' host: '167.71.22.62' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 157.245.240.239
country_id: 6252001
description:
2026-01-31  1:39:10 4536 [Warning] Aborted connection 4536 to db: 'unconnected' user: 'unauthenticated' host: '157.245.240.239' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:39:21 dovecot_login authenticator failed for H=(jkEWKE3S) [185.230.124.69]:52364: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:39:48 dovecot_login authenticator failed for H=(nUXL33JI1) [158.94.208.175]:51383: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:39:50 dovecot_login authenticator failed for H=(AQlI0H6w) [178.16.54.138]:58677: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
country_id: 1814991
description:
2026-01-31 01:39:01 dovecot_login authenticator failed for H=([112.194.142.167]) [112.194.142.167]:56042: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.64.246
country_id: 1512440
description:
2026-01-31 01:39:08 dovecot_login authenticator failed for H=([213.230.64.246]) [213.230.64.246]:41870: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:39:07 dovecot_login authenticator failed for H=(wnHtlPoC6) [185.230.124.69]:61893: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:40:04 dovecot_login authenticator failed for H=(J2eQ4L1s) [178.16.54.22]:54551: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:40:06 dovecot_login authenticator failed for H=(0YbTZ8kcH0) [185.230.124.69]:49733: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:40:23 dovecot_login authenticator failed for H=(zE7yZGKW) [178.16.54.138]:54280: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:40:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:40:22 dovecot_login authenticator failed for H=(7fS2Ne) [158.94.208.175]:54741: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.106
country_id: 1269750
description:
2026-01-31 01:40:52 dovecot_login authenticator failed for H=(nsg-corporate-203.184.185.122.airtel.in) [152.52.244.106]:37820: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:41:23 dovecot_login authenticator failed for H=(JKt5JkFm) [185.230.124.69]:64324: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:41:29 dovecot_login authenticator failed for H=(oz32MF) [178.16.54.138]:58571: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:41:45 dovecot_login authenticator failed for H=(7NIWJPuL) [158.94.208.175]:51034: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.122.115.9
country_id: 1835841
description:
2026-01-31 01:41:04 dovecot_login authenticator failed for H=([220.122.115.9]) [220.122.115.9]:57164: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2026-01-31 01:41:07 dovecot_login authenticator failed for H=c-71-235-27-139.hsd1.vt.comcast.net [71.235.27.139]:37860: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.50
country_id: 2017370
description:
2026-01-31 01:41:17 dovecot_login authenticator failed for H=([178.178.222.50]) [178.178.222.50]:49424: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:41:30 dovecot_login authenticator failed for H=(aKsDbH7eTH) [178.16.54.22]:50961: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2026-01-31 01:41:46 dovecot_login authenticator failed for H=(nsg-corporate-58.202.186.122.airtel.in) [122.186.202.58]:37266: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.195
country_id: 6252001
description:
Jan 31 01:42:49 sv3 pure-ftpd[3634005]: (?@198.235.24.195) [INFO] New connection from 198.235.24.195


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:42:07 dovecot_login authenticator failed for H=(ZWW4C1yT) [178.16.54.138]:58803: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:42:15 dovecot_login authenticator failed for H=(14O6zXi) [158.94.208.175]:57741: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:41:49 dovecot_login authenticator failed for H=(B1OAJvyZug) [185.230.124.69]:60950: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:42:05 dovecot_login authenticator failed for H=(jDuowG) [178.16.54.22]:49728: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.234.9.218
country_id: 2017370
description:
2026-01-31 01:41:58 dovecot_login authenticator failed for H=([213.234.9.218]) [213.234.9.218]:49864: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:43:21 dovecot_login authenticator failed for H=(WnlDte) [178.16.54.22]:52300: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.251.73
country_id: 1269750
description:
2026-01-31 01:43:41 dovecot_login authenticator failed for H=(nsg-corporate-73.251.187.122.airtel.in) [122.187.251.73]:57928: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:43:54 dovecot_login authenticator failed for H=(QyQZwkI) [178.16.54.22]:63414: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:43:25 dovecot_login authenticator failed for H=(72apwbU) [178.16.54.138]:62527: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:43:03 dovecot_login authenticator failed for H=(OLQDM8UcOs) [185.230.124.69]:65395: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:43:06 dovecot_login authenticator failed for H=(3uSdUf) [158.94.208.175]:57491: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-31 01:43:20 H=([64.89.160.15]) [64.89.160.15]:58212 F=<drdavid00r5@outlook.com> rejected RCPT <tst@tst-ma.com>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.181
country_id: 6252001
description:
2026-01-31 01:43:48 dovecot_login authenticator failed for H=(fabfibernet.com) [192.81.229.181]:39486: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:44:03 dovecot_login authenticator failed for H=(be7lXEqa3D) [185.230.124.69]:51356: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.250.44.123
country_id: 1643084
description:
[2026-01-31 01:44:14 +0800] info [cpaneld] 180.250.44.123 - adssadadsa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user adssadadsa (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:44:41 dovecot_login authenticator failed for H=(WHn2qHk) [178.16.54.138]:53677: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.173.121.100
country_id: 1814991
description:
2026-01-31 01:44:04 dovecot_login authenticator failed for H=([180.173.121.100]) [180.173.121.100]:20176: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.16.40.3
country_id: 1814991
description:
2026-01-31 01:44:20 dovecot_login authenticator failed for H=([110.16.40.3]) [110.16.40.3]:23508: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:44:42 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:44:51 dovecot_login authenticator failed for H=(PB3oRS7) [158.94.208.175]:62987: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:44:25 dovecot_login authenticator failed for H=(S3IX8FE) [178.16.54.22]:65116: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:45:09 dovecot_login authenticator failed for H=(WPCeuNiKl) [178.16.54.22]:62173: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:45:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:45:23 dovecot_login authenticator failed for H=(HBerB2Lp) [185.230.124.69]:51120: 535 Incorrect authentication data (set_id=celine@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:45:18 dovecot_login authenticator failed for H=(1MLyKKjJ) [158.94.208.175]:58375: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2026-01-31 01:46:00 dovecot_login authenticator failed for H=([185.134.179.106]) [185.101.16.250]:54026: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:46:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:46:14 dovecot_login authenticator failed for H=(EITLomQ) [185.230.124.69]:62131: 535 Incorrect authentication data (set_id=celine@ktlog.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:46:41 dovecot_login authenticator failed for H=(keD75z) [185.230.124.69]:55730: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2026-01-31 01:46:47 dovecot_login authenticator failed for H=([38.226.118.9]) [38.226.118.0]:59854: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:46:01 dovecot_login authenticator failed for H=(08LxhJG3) [178.16.54.138]:53701: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:46:07 dovecot_login authenticator failed for H=(0lsLOU7f) [158.94.208.175]:64308: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:46:12 dovecot_login authenticator failed for H=(63JRWE) [178.16.54.22]:63892: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:47:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.233.246
country_id: 1269750
description:
2026-01-31 01:47:33 dovecot_login authenticator failed for H=([125.17.236.223]) [125.17.233.246]:50534: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:47:27 dovecot_login authenticator failed for H=(n0YfKDc) [158.94.208.175]:64470: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:47:30 dovecot_login authenticator failed for H=(I4ovUcGsa) [178.16.54.22]:52350: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:47:07 dovecot_login authenticator failed for H=(9SV6KGR) [185.230.124.69]:64820: 535 Incorrect authentication data (set_id=celine@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.42.45.27
country_id: 2921044
description:
2026-01-31 01:47:13 dovecot_plain authenticator failed for H=purple-lemur-47989.zap.cloud [92.42.45.27]:61116: 535 Incorrect authentication data (set_id=jesslim@imax.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:47:12 dovecot_login authenticator failed for H=(Sgu3C1) [178.16.54.138]:54157: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.46
country_id: 1036973
description:
2026-01-31 01:47:15 dovecot_login authenticator failed for H=(dynamic-adsl.movitel.co.mz) [197.219.210.46]:41642: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:48:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.38.68.223
country_id: 1269750
domain: stillman.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:20346.stillman.my||ServerName:stillman.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c51c866578208d4ec766aacba368494449112903||Title:0xf8668b1f||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:48:20 dovecot_login authenticator failed for H=(RpV7xPRgi2) [185.230.124.69]:60065: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.106
country_id: 1269750
description:
2026-01-31 01:48:34 dovecot_login authenticator failed for H=(nsg-corporate-203.184.185.122.airtel.in) [152.52.244.106]:52558: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.217.143
country_id: 3041565
description:
2026-01-31 01:48:37 dovecot_login authenticator failed for H=(ADMIN) [173.239.217.143]:52927: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:48:46 dovecot_login authenticator failed for H=(fR0mkVq1) [178.16.54.138]:63986: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.255.50
country_id: 1269750
description:
2026-01-31 01:48:14 dovecot_login authenticator failed for H=([122.186.255.50]) [122.186.255.50]:48646: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:48:21 dovecot_login authenticator failed for H=(FIYIGGB2S) [158.94.208.175]:63504: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:48:06 dovecot_login authenticator failed for H=(4JS6C73) [178.16.54.22]:62977: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.244.152.101
country_id: 99237
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=62821516780656 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:49:13 dovecot_login authenticator failed for H=(0WPvX3) [178.16.54.22]:52187: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:49:13 dovecot_login authenticator failed for H=(mahCZFD) [158.94.208.175]:57744: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 01:49:37 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account felioit has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:49:39 dovecot_login authenticator failed for H=(GMyNOeB) [185.230.124.69]:49505: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.170.15
country_id: 3175395
description:
2026-01-31 01:49:40 dovecot_plain authenticator failed for H=([100.64.100.6]) [2.57.170.15]:4007: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 177.242.5.231
country_id: 3996063
domain: stillman.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:20299.stillman.my||ServerName:stillman.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c4cd365197397e570328dc98d0d4fd7c178674d6||Title:0x3ee3f3e2||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:49:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine@ktlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.112.126
country_id: 1269750
description:
2026-01-31 01:49:19 dovecot_login authenticator failed for H=([27.123.112.126]) [27.123.112.126]:36986: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:49:08 dovecot_login authenticator failed for H=(U4gRbX) [185.230.124.69]:60472: 535 Incorrect authentication data (set_id=celine@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:50:14 dovecot_login authenticator failed for H=(esNHfOKb4q) [178.16.54.22]:65368: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:50:19 dovecot_login authenticator failed for H=(6UbH1GI) [178.16.54.138]:50285: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:50:21 dovecot_login authenticator failed for H=(wYZa7M7RX5) [185.230.124.69]:49953: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:50:07 dovecot_login authenticator failed for H=(lmpruyyp) [158.94.208.175]:59430: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:50:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine@ktlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 01:50:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account felioit has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:51:02 dovecot_login authenticator failed for H=(QwJkKBJelr) [158.94.208.175]:50923: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:51:12 dovecot_login authenticator failed for H=(o6zJEpgpTz) [185.230.124.69]:51822: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.62
country_id: 1269750
description:
2026-01-31 01:51:41 dovecot_login authenticator failed for H=([125.17.182.121]) [182.95.224.62]:52902: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:51:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine@ktlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:51:42 dovecot_login authenticator failed for H=(xwcrwbqnn) [178.16.54.138]:50811: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:51:13 dovecot_login authenticator failed for H=(DD6MURtw) [178.16.54.22]:60213: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 01:51:51 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account felioit has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.63.207.166
country_id: 3175395
description:
2026-01-31 01:51:58 dovecot_login authenticator failed for H=([151.63.207.166]) [151.63.207.166]:44010: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:52:02 dovecot_login authenticator failed for H=(CfEPIf2) [185.230.124.69]:50335: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:52:20 dovecot_login authenticator failed for H=(YD9RCKIc0P) [158.94.208.175]:61736: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.183.114.175
country_id: 3469034
description:
2026-01-31 01:52:38 dovecot_login authenticator failed for H=([179.183.114.175]) [179.183.114.175]:60824: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 01:52:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account felioit has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.118
country_id: 1149361
description:
2026-01-31 01:52:23 dovecot_login authenticator failed for H=([149.54.62.118]) [149.54.62.118]:43530: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:52:30 dovecot_login authenticator failed for H=(bWwz2BEeo) [185.230.124.69]:61702: 535 Incorrect authentication data (set_id=celine@ktlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:52:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine@ktlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:52:11 dovecot_login authenticator failed for H=(fNx7frhF6) [178.16.54.22]:58546: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:53:14 dovecot_login authenticator failed for H=(GCMfWPCh) [178.16.54.138]:63591: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:53:08 dovecot_login authenticator failed for H=(O2mqvjrvzH) [178.16.54.22]:64222: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 01:53:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account felioit has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:53:13 dovecot_login authenticator failed for H=(IAyinvWd) [158.94.208.175]:60954: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:53:42 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:53:11 dovecot_login authenticator failed for H=(IQhBaMRFgF) [185.230.124.69]:54416: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:54:09 dovecot_login authenticator failed for H=(MWMRJgq) [158.94.208.175]:64831: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.8.111.106
country_id: 1835841
description:
2026-01-31 01:54:28 dovecot_login authenticator failed for H=([59.8.111.106]) [59.8.111.106]:51364: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.71.41
country_id: 6252001
description:
2026-01-31 01:54:37 dovecot_login authenticator failed for H=([209.23.71.41]) [209.23.71.41]:50772: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.0.202
country_id: 2017370
description:
2026-01-31 01:54:03 dovecot_login authenticator failed for H=([83.239.0.202]) [83.239.0.202]:45732: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:54:04 dovecot_login authenticator failed for H=(jAj6z3Kgb8) [178.16.54.22]:52855: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 01:54:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account felioit has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:54:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:54:10 dovecot_login authenticator failed for H=(Vgm6qBtjj) [185.230.124.69]:61893: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: modsec
rule: 77350212
name: IM360 WAF: Information Disclosure Attempt in WordPress
abuser: 81.22.44.50
country_id: 2017370
domain: www.oxbold.com
description:
IM360 WAF: Information Disclosure Attempt in WordPress||MV:/wp-config.php.bak||RSV:7.71||T:APACHE||REQUEST_URI:/wp-config.php.bak||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.73.228.90
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=234981 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 81.22.44.50
country_id: 2017370
domain: www.oxbold.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-config.php.bak||User:oxboldc||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:55:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:55:03 dovecot_login authenticator failed for H=(vTAxzzh) [158.94.208.175]:55926: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:55:23 dovecot_login authenticator failed for H=(krgDdplhZ7) [185.230.124.69]:53194: 535 Incorrect authentication data (set_id=celine@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:55:13 dovecot_login authenticator failed for H=(zJy6wIGo) [178.16.54.138]:57324: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:55:07 dovecot_login authenticator failed for H=(cCN2pq) [178.16.54.22]:57323: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:55:25 dovecot_login authenticator failed for H=(naewDY8Pi) [185.230.124.69]:49863: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:56:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:56:11 dovecot_login authenticator failed for H=(GrS3uEEcv) [185.230.124.69]:50863: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:56:17 dovecot_login authenticator failed for H=(C5jdIlYWuU) [178.16.54.138]:57531: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:56:38 dovecot_login authenticator failed for H=(MT3Gsl) [178.16.54.22]:62619: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:56:24 dovecot_login authenticator failed for H=(xvNhsK1) [158.94.208.175]:53983: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:57:14 dovecot_login authenticator failed for H=(HxcIFS) [158.94.208.175]:65254: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:57:33 dovecot_login authenticator failed for H=(OQKu01Lq) [178.16.54.22]:54769: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-31 01:57:42 H=(localhost.localdomain) [78.153.140.207]:56988 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:57:02 dovecot_login authenticator failed for H=(Sw1uhH) [185.230.124.69]:64000: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:57:28 dovecot_login authenticator failed for H=(tHG6p52) [178.16.54.138]:50826: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:57:00 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.47.138.157
country_id: 6252001
description:
2026-01-31 01:57:15 dovecot_login authenticator failed for H=(136-47-138-157.googlefiber.net) [136.47.138.157]:53466: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.235.145.22
country_id: 2017370
description:
2026-01-31 01:57:23 dovecot_login authenticator failed for H=(188x235x145x22.static-business.saratov.ertelecom.ru) [188.235.145.22]:56586: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:58:02 dovecot_login authenticator failed for H=(xWUmPvQ) [178.16.54.138]:64792: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:58:06 dovecot_login authenticator failed for H=(DId1iHwe) [158.94.208.175]:55004: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:58:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine@ktlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:58:19 dovecot_login authenticator failed for H=(k4EmDGJ1BT) [185.230.124.69]:63208: 535 Incorrect authentication data (set_id=celine@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:58:22 dovecot_login authenticator failed for H=(oKUziQMG0) [185.230.124.69]:50264: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:59:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine@ktlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:59:23 dovecot_login authenticator failed for H=(XjaI5fzR01) [158.94.208.175]:58773: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:59:37 dovecot_login authenticator failed for H=(pihTJcj) [178.16.54.22]:57603: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:59:04 dovecot_login authenticator failed for H=(tDEOGNhXa) [185.230.124.69]:59681: 535 Incorrect authentication data (set_id=celine@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:59:10 dovecot_login authenticator failed for H=(9NqyrRJ7P) [178.16.54.138]:59848: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2026-01-31 01:59:51 dovecot_login authenticator failed for H=([65.20.204.88]) [65.20.204.88]:35617: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 02:00:17 dovecot_login authenticator failed for H=(S8APEQJg) [178.16.54.138]:51106: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:00:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine@ktlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.42.190.241
country_id: 6252001
description:
2026-01-31 02:00:08 dovecot_login authenticator failed for H=host241.sub-63-42-190.myvzw.com [63.42.190.241]:40728: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 02:00:07 dovecot_login authenticator failed for H=(MahFahTR) [178.16.54.22]:58145: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:00:43 dovecot_login authenticator failed for H=(glcO1K) [185.230.124.69]:49238: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:00:00 dovecot_login authenticator failed for H=(PHugUd) [185.230.124.69]:64702: 535 Incorrect authentication data (set_id=celine@ktlog.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.186
country_id: 2750405
description:
2026-01-31  2:00:13 5297 [Warning] Aborted connection 5297 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.186' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 02:00:21 dovecot_login authenticator failed for H=(RkT3T7ot) [158.94.208.175]:54619: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:01:09 dovecot_login authenticator failed for H=(T490pSpYD) [185.230.124.69]:61217: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 02:01:26 dovecot_login authenticator failed for H=(VUJID4tkRr) [178.16.54.138]:58011: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.186
country_id: 2750405
description:
2026-01-31  2:01:21 5321 [Warning] Aborted connection 5321 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.186' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 02:01:12 dovecot_login authenticator failed for H=(WmqTvDFMC0) [178.16.54.22]:57420: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:01:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine@ktlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 02:01:14 dovecot_login authenticator failed for H=(CfWvsjZmB) [158.94.208.175]:57611: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.55.237.165
country_id: 1562822
description:
2026-01-31 02:01:01 dovecot_login authenticator failed for H=([1.55.237.165]) [1.55.237.165]:57952: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 02:02:01 dovecot_login authenticator failed for H=(TnzGRh8SM8) [178.16.54.138]:58812: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:02:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine@ktlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:02:02 dovecot_login authenticator failed for H=(wxkzDCJgn6) [185.230.124.69]:55994: 535 Incorrect authentication data (set_id=richard@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 02:02:08 dovecot_login authenticator failed for H=(2QI4rER) [158.94.208.175]:57975: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:02:27 dovecot_login authenticator failed for H=(ckQAjh3o) [185.230.124.69]:64621: 535 Incorrect authentication data (set_id=richard@kendek.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:03:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 02:03:11 dovecot_login authenticator failed for H=(8cDpuHbo) [178.16.54.138]:63459: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 02:03:51 dovecot_login authenticator failed for H=(hk22pX) [158.94.208.175]:60431: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 24.152.33.21
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=7&sub=42 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.63.234.164
country_id: 3469034
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=5044 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:03:08 dovecot_login authenticator failed for H=(rdk8XiGqfJ) [185.230.124.69]:58063: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.202.80.152
country_id: 1835841
description:
2026-01-31 02:03:11 dovecot_login authenticator failed for H=([114.202.80.152]) [114.202.80.152]:39514: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.146.93.14
country_id: 1668284
description:
2026-01-31 02:03:02 dovecot_login authenticator failed for H=(122-146-93-14.adsl.static.sparqnet.net) [122.146.93.14]:38716: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 02:03:03 dovecot_login authenticator failed for H=(5ofXbk3yp) [178.16.54.22]:49532: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 02:04:18 dovecot_login authenticator failed for H=(xE7mMoO3) [178.16.54.22]:62998: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 02:04:23 dovecot_login authenticator failed for H=(qslXwOy5Bd) [158.94.208.175]:65317: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 02:04:24 dovecot_login authenticator failed for H=(Q4kKzJG) [178.16.54.138]:60522: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:04:26 dovecot_login authenticator failed for H=(SfmASfDA) [185.230.124.69]:64631: 535 Incorrect authentication data (set_id=recruitment)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:04:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account richard@kendek.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:04:10 dovecot_login authenticator failed for H=(AiWJIy) [185.230.124.69]:50466: 535 Incorrect authentication data (set_id=richard@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 02:05:12 dovecot_login authenticator failed for H=(FooXdG04) [178.16.54.22]:52911: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 02:05:16 dovecot_login authenticator failed for H=(3j0LkqMY5B) [158.94.208.175]:50991: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:05:30 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account richard@kendek.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:05:11 dovecot_login authenticator failed for H=(acP9RJevJ3) [185.230.124.69]:51800: 535 Incorrect authentication data (set_id=celine@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2026-01-31 02:05:30 dovecot_plain authenticator failed for H=c-73-196-144-25.hsd1.nj.comcast.net (garnable) [73.196.144.25]:40692: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.57.146
country_id: 2921044
description:
2026-01-31 02:05:53 dovecot_login authenticator failed for H=(ADMIN) [212.102.57.146]:25106: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:05:58 dovecot_login authenticator failed for H=(w2JD9yIQ) [185.230.124.69]:65460: 535 Incorrect authentication data (set_id=richard@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 02:05:27 dovecot_login authenticator failed for H=(b8qGQX82) [178.16.54.138]:64419: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.30.21
country_id: 1562822
description:
2026-01-31 02:06:08 dovecot_login authenticator failed for H=([27.71.30.21]) [27.71.30.21]:5790: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:06:03 dovecot_login authenticator failed for H=(hMENc11HF) [185.230.124.69]:63203: 535 Incorrect authentication data (set_id=celine@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2026-01-31 02:06:20 dovecot_login authenticator failed for H=([128.185.23.89]) [125.19.160.206]:52376: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 02:06:12 dovecot_login authenticator failed for H=(EQU2Fw5) [158.94.208.175]:58678: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.53.130.4
country_id: 1814991
description:
2026-01-31 02:06:25 dovecot_login authenticator failed for H=([116.53.130.4]) [116.53.130.4]:34622: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.172
country_id: 1733045
description:
2026-01-31 02:06:40 dovecot_login authenticator failed for H=([49.124.154.172]) [49.124.154.172]:58716: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 02:06:01 dovecot_login authenticator failed for H=(YFDgjv) [178.16.54.138]:60192: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-31 02:06:15 H=(localhost.localdomain) [78.153.140.207]:60080 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:06:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account richard@kendek.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:07:09 dovecot_login authenticator failed for H=(EQonioWX) [185.230.124.69]:60911: 535 Incorrect authentication data (set_id=charlote.ling@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 02:07:09 dovecot_login authenticator failed for H=(BncntKd) [178.16.54.138]:55624: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:07:18 dovecot_login authenticator failed for H=(dD20T8) [185.230.124.69]:51819: 535 Incorrect authentication data (set_id=recruitment)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 02:07:48 dovecot_login authenticator failed for H=(9cyKfV1cUZ) [178.16.54.22]:57429: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 02:07:08 dovecot_login authenticator failed for H=(ueyRxbA) [158.94.208.175]:55594: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:07:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine@ktlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:08:03 dovecot_login authenticator failed for H=(96oVuzRFDR) [185.230.124.69]:51828: 535 Incorrect authentication data (set_id=recruitment)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 02:08:13 dovecot_login authenticator failed for H=(gJAz3kKDSy) [158.94.208.175]:56185: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 34.76.34.183
country_id: 2802361
description:
Jan 31 02:08:22 sv3 pure-ftpd[3650685]: (?@34.76.34.183) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:08:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-31 02:08:11 H=([64.89.160.15]) [64.89.160.15]:62889 F=<drdavid00r5@outlook.com> rejected RCPT <janice@smartcable.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 02:09:26 dovecot_login authenticator failed for H=(sV7jfkvtg) [158.94.208.175]:59276: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.238.189.155
country_id: 3996063
domain: www.kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kendek.com/product-detail.php?id=185808 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:09:01 dovecot_login authenticator failed for H=(Wo7aWf4) [185.230.124.69]:51929: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:09:02 dovecot_login authenticator failed for H=(kpill2BBf) [185.230.124.69]:56667: 535 Incorrect authentication data (set_id=richard@kendek.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:09:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:10:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account charlote.ling@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:10:06 dovecot_login authenticator failed for H=(WkKbDq2kF) [185.230.124.69]:65233: 535 Incorrect authentication data (set_id=charlote.ling@cofreth.com.my)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 34.52.238.9
country_id: 2802361
description:
Jan 31 02:10:16 sv3 pure-ftpd[3651927]: (?@34.52.238.9) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:10:23 dovecot_login authenticator failed for H=(OK0APmn0) [185.230.124.69]:56969: 535 Incorrect authentication data (set_id=recruitment)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:11:09 dovecot_login authenticator failed for H=(CuLxFFjqa) [185.230.124.69]:50165: 535 Incorrect authentication data (set_id=richard@kendek.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:11:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 02:11:11 dovecot_login authenticator failed for H=(vMu96QGM) [158.94.208.175]:55008: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:11:53 dovecot_login authenticator failed for H=(tqER6MFxCO) [185.230.124.69]:52725: 535 Incorrect authentication data (set_id=richard@kendek.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.248.24.238
country_id: 798544
domain: old.nexuscollection.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/var/www/html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.46.193.187
country_id: 1814991
description:
2026-01-31 02:12:39 dovecot_login authenticator failed for H=([59.46.193.187]) [59.46.193.187]:59469: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:12:04 dovecot_login authenticator failed for H=(Xd2coJWHZz) [185.230.124.69]:58268: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:12:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account charlote.ling@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 02:12:28 dovecot_login authenticator failed for H=(DvNk2pNJ) [158.94.208.175]:63816: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:13:03 dovecot_login authenticator failed for H=(7qYYxbjev) [185.230.124.69]:52117: 535 Incorrect authentication data (set_id=charlote.ling@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 02:13:20 dovecot_login authenticator failed for H=(qSpAdqC9) [158.94.208.175]:54428: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.17.217.141
country_id: 1814991
description:
2026-01-31 02:13:01 dovecot_login authenticator failed for H=([218.17.217.141]) [218.17.217.141]:18744: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.166
country_id: 1269750
description:
2026-01-31 02:13:09 dovecot_login authenticator failed for H=([125.19.175.250]) [122.185.146.166]:55940: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.117.0.253
country_id: 1835841
description:
2026-01-31 02:13:25 dovecot_login authenticator failed for H=([222.117.0.253]) [222.117.0.253]:53195: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:13:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account charlote.ling@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.104.194.23
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/debug/Tests/MockExceptionHandler.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:13:26 dovecot_login authenticator failed for H=(tUwxbSSTq) [185.230.124.69]:56689: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:14:05 dovecot_login authenticator failed for H=(rWTvp0Ea8p) [185.230.124.69]:59024: 535 Incorrect authentication data (set_id=charlote.ling@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 02:14:13 dovecot_login authenticator failed for H=(qKbc9F) [158.94.208.175]:64149: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:14:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account richard@kendek.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.142
country_id: 2186224
description:
2026-01-31 02:14:37 dovecot_login authenticator failed for H=([121.73.168.142]) [121.73.168.142]:41278: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.81.124.38
country_id: 3686110
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=22681514863685 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.6.31
country_id: 1880251
description:
2026-01-31 02:14:52 dovecot_login authenticator failed for H=(31.6.245.49.unknown.m1.com.sg) [49.245.6.31]:39531: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:14:54 dovecot_login authenticator failed for H=(GF1bevHT) [185.230.124.69]:62202: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:15:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account richard@kendek.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.207.33.248
country_id: 6290252
description:
2026-01-31 02:15:35 dovecot_login authenticator failed for H=([109.207.33.248]) [109.207.33.248]:33773: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:15:08 dovecot_login authenticator failed for H=(dGDNSS0W2O) [185.230.124.69]:57652: 535 Incorrect authentication data (set_id=richard@kendek.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-31 02:15:10 H=([64.89.160.15]) [64.89.160.15]:60460 F=<essenas@outlook.com> rejected RCPT <tst@tst-ma.com>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-01-31 02:15:23 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:36687: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 02:15:07 dovecot_login authenticator failed for H=(JxyMCBC) [158.94.208.175]:59110: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:16:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 02:16:51 dovecot_login authenticator failed for H=(S60jaP) [158.94.208.175]:61970: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:16:01 dovecot_login authenticator failed for H=(WErqO404) [185.230.124.69]:54462: 535 Incorrect authentication data (set_id=richard@kendek.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:16:13 dovecot_login authenticator failed for H=(dr3SZt) [185.230.124.69]:55243: 535 Incorrect authentication data (set_id=celine)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.49.254.255
country_id: 1269750
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:10306.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:befba933f20fb4da32a96868267a6d904eee170b||Title:0xb23a1231||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 02:16:49 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account felioit@feliogroup.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.207.227
country_id: 1282988
description:
2026-01-31 02:17:57 dovecot_login authenticator failed for H=([103.130.207.227]) [103.130.207.227]:36446: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:17:06 dovecot_login authenticator failed for H=(oEzIYc) [185.230.124.69]:64671: 535 Incorrect authentication data (set_id=recruitment)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 02:17:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account felioit@feliogroup.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 02:17:18 dovecot_login authenticator failed for H=(YdYSkRl) [158.94.208.175]:51085: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:17:44 dovecot_login authenticator failed for H=(1zJrP0q0ND) [185.230.124.69]:64434: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.5
country_id: 3469034
description:
2026-01-31 02:17:50 dovecot_login authenticator failed for H=(mamanguape.static.gvt.net.br) [177.207.248.5]:41897: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:17:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.34.17.130
country_id: 1814991
description:
2026-01-31 02:17:40 dovecot_login authenticator failed for H=([59.34.17.130]) [59.34.17.130]:43557: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 02:18:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account felioit@feliogroup.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:18:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account charlote.ling@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.154.217.188
country_id: 690791
description:
2026-01-31 02:18:10 dovecot_login authenticator failed for H=ip-d9bc.d-net.kiev.ua [94.154.217.188]:59600: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 02:18:13 dovecot_login authenticator failed for H=(rswiTwB) [158.94.208.175]:65529: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:18:44 dovecot_login authenticator failed for H=(DuGGThIltp) [185.230.124.69]:65398: 535 Incorrect authentication data (set_id=recruitment)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:18:03 dovecot_login authenticator failed for H=(BoDOzje) [185.230.124.69]:49595: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.22
country_id: 1269750
description:
2026-01-31 02:18:26 dovecot_login authenticator failed for H=(aes-static-105.28.22.125.airtel.in) [182.95.228.22]:57226: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.206
country_id: 1269750
description:
2026-01-31 02:18:17 dovecot_login authenticator failed for H=([182.95.178.206]) [182.95.178.206]:49464: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:19:06 dovecot_login authenticator failed for H=(FGo4E2dZ) [185.230.124.69]:63493: 535 Incorrect authentication data (set_id=richard@kendek.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:19:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:19:58 dovecot_login authenticator failed for H=(mTBJ75qNA4) [185.230.124.69]:63664: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:20:42 dovecot_login authenticator failed for H=(ElJChqG) [45.94.31.131]:56551: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 02:20:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account felioit@feliogroup.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 02:20:04 dovecot_login authenticator failed for H=(WboEzBMRn) [158.94.208.175]:57942: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:20:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account charlote.ling@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:20:17 dovecot_login authenticator failed for H=(XAeAGYUt) [185.230.124.69]:57684: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.219.80
country_id: 3144096
description:
2026-01-31 02:21:22 dovecot_login authenticator failed for H=(cm-84.210.219.80.get.no) [84.210.219.80]:38600: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:21:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account charlote.ling@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 02:21:27 dovecot_login authenticator failed for H=(5aaYGm8) [158.94.208.175]:54254: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:21:03 dovecot_login authenticator failed for H=(qWQTyh3z) [45.94.31.131]:61569: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.243.234.23
country_id: 6252001
description:
2026-01-31 02:21:03 dovecot_login authenticator failed for H=c-73-243-234-23.hsd1.co.comcast.net [73.243.234.23]:53844: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2026-01-31 02:21:05 dovecot_login authenticator failed for H=(m121-202-138-181.smartone.com) [121.202.138.181]:55090: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:21:12 dovecot_login authenticator failed for H=(K9on5g0YA) [185.230.124.69]:55795: 535 Incorrect authentication data (set_id=charlote.ling@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:21:11 dovecot_login authenticator failed for H=(GbkeGD3) [185.230.124.69]:52178: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:22:29 dovecot_login authenticator failed for H=(wifOwufTq) [185.230.124.69]:63822: 535 Incorrect authentication data (set_id=richard@kendek.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-31 02:22:50 H=([64.89.160.15]) [64.89.160.15]:56328 F=<drdavid00r5@outlook.com> rejected RCPT <miya@hmz.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.6.250.242
country_id: 6252001
description:
2026-01-31 02:22:14 dovecot_login authenticator failed for H=(ADMIN) [50.6.250.242]:56460: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.148.230.26
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=739548 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:22:03 dovecot_login authenticator failed for H=(c5SdbI) [45.94.31.131]:64340: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.200
country_id: 1269750
description:
2026-01-31 02:23:01 dovecot_login authenticator failed for H=([103.146.233.200]) [103.146.233.200]:60866: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:22:03 dovecot_login authenticator failed for H=(yEgc2NX) [185.230.124.69]:55911: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.145.160.110
country_id: 1269750
description:
2026-01-31 02:22:52 dovecot_login authenticator failed for H=([125.19.173.191]) [59.145.160.110]:45862: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:22:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:23:02 dovecot_login authenticator failed for H=(eJnVkxsj) [45.94.31.131]:63899: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:23:39 dovecot_login authenticator failed for H=(Zd9t0dYAS) [185.230.124.69]:52573: 535 Incorrect authentication data (set_id=richard@kendek.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:23:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:23:13 dovecot_login authenticator failed for H=(V1X83Jz9a0) [185.230.124.69]:57126: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:23:38 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:24:51 dovecot_login authenticator failed for H=(JMHs9t5) [185.230.124.69]:50819: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
country_id: 3932488
description:
2026-01-31 02:24:52 dovecot_login authenticator failed for H=([45.170.50.2]) [45.170.50.2]:40473: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.166.214
country_id: 1814991
description:
2026-01-31 02:24:02 dovecot_login authenticator failed for H=([220.180.166.214]) [220.180.166.214]:45509: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.21
country_id: 1269750
description:
2026-01-31 02:24:33 dovecot_login authenticator failed for H=(nsg-corporate-21.226.187.122.airtel.in) [122.187.226.21]:33650: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:24:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:24:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:24:19 dovecot_login authenticator failed for H=(Nc77fUSM) [45.94.31.131]:54377: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:24:03 dovecot_login authenticator failed for H=(TlxZv6M) [185.230.124.69]:50391: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.115.60.4
country_id: 1668284
description:
2026-01-31 02:24:13 dovecot_login authenticator failed for H=(58-115-60-4.twt1.com.tw) [58.115.60.4]:47657: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.62.50.107
country_id: 1694008
description:
2026-01-31 02:24:11 dovecot_plain authenticator failed for H=(398XN2FAL8) [158.62.50.107]:57206: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:25:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:25:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:25:16 dovecot_login authenticator failed for H=(oeVw33n) [45.94.31.131]:63179: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:25:09 dovecot_login authenticator failed for H=(jDSrKz) [185.230.124.69]:54390: 535 Incorrect authentication data (set_id=richard)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:26:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2026-01-31 02:26:36 dovecot_login authenticator failed for H=ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:38482: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.63.87
country_id: 1814991
description:
2026-01-31 02:26:53 dovecot_login authenticator failed for H=([111.26.63.87]) [111.26.63.87]:58378: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.232.252.106
country_id: 1814991
description:
2026-01-31 02:26:22 dovecot_login authenticator failed for H=([112.232.252.106]) [112.232.252.106]:51174: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.246.106
country_id: 1269750
description:
2026-01-31 02:26:45 dovecot_login authenticator failed for H=([125.19.172.119]) [125.20.246.106]:46578: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:26:01 dovecot_login authenticator failed for H=(WvQZ6PF) [185.230.124.69]:58019: 535 Incorrect authentication data (set_id=charlote.ling@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:26:15 dovecot_login authenticator failed for H=(nKxgaP) [45.94.31.131]:51333: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:26:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:26:09 dovecot_login authenticator failed for H=(S5PHyh) [185.230.124.69]:51150: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:27:05 dovecot_login authenticator failed for H=(2tYx8Qzy) [185.230.124.69]:52100: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:27:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:27:15 dovecot_login authenticator failed for H=(9z35wmuB) [45.94.31.131]:49378: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.90.30.233
country_id: 1269750
description:
2026-01-31 02:27:50 dovecot_login authenticator failed for H=([59.90.30.233]) [59.90.30.233]:37728: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:27:04 dovecot_login authenticator failed for H=(MjRFbep) [185.230.124.69]:63073: 535 Incorrect authentication data (set_id=richard)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:27:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account charlote.ling@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.198.134.241
country_id: 2017370
description:
2026-01-31 02:28:22 dovecot_login authenticator failed for H=(host-94.198.134.241.vernet.su) [94.198.134.241]:55148: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.23
country_id: 1269750
description:
2026-01-31 02:28:39 dovecot_login authenticator failed for H=([103.147.248.23]) [103.147.248.23]:49730: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:28:02 dovecot_login authenticator failed for H=(5AS4NojG4) [185.230.124.69]:60356: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:28:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account charlote.ling@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:28:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:28:14 dovecot_login authenticator failed for H=(F5v1wh) [45.94.31.131]:62004: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:28:15 dovecot_login authenticator failed for H=(PWAEQUM4EJ) [185.230.124.69]:61857: 535 Incorrect authentication data (set_id=recruitment)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.37.13.66
country_id: 1814991
description:
2026-01-31 02:28:26 dovecot_login authenticator failed for H=([59.37.13.66]) [59.37.13.66]:41933: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.74.194.86
country_id: 1522867
description:
2026-01-31 02:28:54 dovecot_login authenticator failed for H=(2-74-194-86.kcell.kz) [2.74.194.86]:55020: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:29:09 dovecot_login authenticator failed for H=(YIFOQf) [185.230.124.69]:60572: 535 Incorrect authentication data (set_id=richard)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.143.69.79
country_id: 2750405
description:
2026-01-31 02:29:28 dovecot_login authenticator failed for H=([108.143.69.79]) [108.143.69.79]:42204: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:29:15 dovecot_login authenticator failed for H=(ZvIQOqEHxp) [45.94.31.131]:49262: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:29:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account richard has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.87
country_id: 2186224
description:
2026-01-31 02:29:10 dovecot_login authenticator failed for H=([121.73.163.87]) [121.73.163.87]:49406: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:29:36 dovecot_login authenticator failed for H=(DGhDg1w3) [185.230.124.69]:64484: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.171.27.248
country_id: 1814991
description:
2026-01-31 02:29:52 dovecot_login authenticator failed for H=([116.171.27.248]) [116.171.27.248]:58802: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:30:52 dovecot_login authenticator failed for H=(nH0nyyTRV3) [185.230.124.69]:64544: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.246.27
country_id: 2017370
description:
2026-01-31 02:30:52 dovecot_login authenticator failed for H=([46.8.246.27]) [46.8.246.27]:44800: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.216.165.187
country_id: 2017370
description:
2026-01-31 02:30:44 dovecot_login authenticator failed for H=([178.216.165.187]) [178.216.165.187]:35408: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:30:18 dovecot_login authenticator failed for H=(oS7heGAKv) [45.94.31.131]:56378: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:30:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account richard has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:30:01 dovecot_login authenticator failed for H=(J7DxbNb8G) [185.230.124.69]:51947: 535 Incorrect authentication data (set_id=richard)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:31:59 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:31:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:31:08 dovecot_login authenticator failed for H=(PRWHcr) [185.230.124.69]:56055: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:31:21 dovecot_login authenticator failed for H=(GETjiXNPKq) [45.94.31.131]:56727: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:32:01 dovecot_login authenticator failed for H=(JsDBL2Q2EE) [45.94.31.131]:52486: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:32:06 dovecot_login authenticator failed for H=(3GS2Kijg) [185.230.124.69]:51638: 535 Incorrect authentication data (set_id=richard)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:32:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account richard has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:32:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2026-01-31 02:32:52 dovecot_login authenticator failed for H=h79-138-90-195.cust.bredband2.com [79.138.90.195]:36860: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:32:31 dovecot_login authenticator failed for H=(K7Eq4M2) [185.230.124.69]:53314: 535 Incorrect authentication data (set_id=richard)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:33:02 dovecot_login authenticator failed for H=(LSPhlF4s6) [45.94.31.131]:49639: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:33:00 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2026-01-31 02:33:01 dovecot_login authenticator failed for H=(177-174-16-81.user.vivozap.com.br) [177.174.16.55]:35122: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:33:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:33:16 dovecot_login authenticator failed for H=(Bb1a5Z9s) [185.230.124.69]:61041: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:34:01 dovecot_login authenticator failed for H=(Qc8X3T4) [185.230.124.69]:58321: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:34:01 dovecot_login authenticator failed for H=(mVZ6pEr) [45.94.31.131]:65344: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:34:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account charlote.ling has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:34:07 dovecot_login authenticator failed for H=(Bk2g9tx) [185.230.124.69]:53179: 535 Incorrect authentication data (set_id=charlote.ling)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:34:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:35:53 dovecot_login authenticator failed for H=(mlpwVQM) [185.230.124.69]:64464: 535 Incorrect authentication data (set_id=charlote.ling)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:35:01 dovecot_login authenticator failed for H=(bkIWXeVJT) [45.94.31.131]:63110: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:35:06 dovecot_login authenticator failed for H=(3V9IDKs8) [185.230.124.69]:50458: 535 Incorrect authentication data (set_id=richard)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:35:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account charlote.ling has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:35:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:36:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account charlote.ling has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:36:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:36:01 dovecot_login authenticator failed for H=(cgKDBlaC9A) [45.94.31.131]:60322: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:36:10 dovecot_login authenticator failed for H=(oVN43qk) [185.230.124.69]:50660: 535 Incorrect authentication data (set_id=richard)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:37:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account charlote.ling has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:37:18 dovecot_login authenticator failed for H=(qD7VEWiHWW) [45.94.31.131]:65090: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:37:51 dovecot_login authenticator failed for H=(ZoTYRJ0jkw) [185.230.124.69]:49243: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:37:04 dovecot_login authenticator failed for H=(LnHbslXXH) [185.230.124.69]:50709: 535 Incorrect authentication data (set_id=charlote.ling)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:38:19 dovecot_login authenticator failed for H=(sGjmRT0) [185.230.124.69]:60956: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:38:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account richard has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.23.168
country_id: 1814991
description:
2026-01-31 02:38:09 dovecot_login authenticator failed for H=([120.238.23.168]) [120.238.23.168]:53758: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:38:16 dovecot_login authenticator failed for H=(sIw2oLQgK) [45.94.31.131]:49970: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:39:05 dovecot_login authenticator failed for H=(hdSzoLw) [185.230.124.69]:55925: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:39:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account richard has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:39:15 dovecot_login authenticator failed for H=(ZUWjLjjHD) [45.94.31.131]:57637: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:39:43 dovecot_login authenticator failed for H=(i5nwlz) [185.230.124.69]:55865: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.15.224.102
country_id: 1814991
description:
2026-01-31 02:40:36 dovecot_login authenticator failed for H=([218.15.224.102]) [218.15.224.102]:58426: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.79.227.51
country_id: 1835841
description:
2026-01-31 02:40:45 dovecot_login authenticator failed for H=([61.79.227.51]) [61.79.227.51]:54292: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:40:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account richard has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:40:09 dovecot_login authenticator failed for H=(iIJgh9) [185.230.124.69]:60524: 535 Incorrect authentication data (set_id=richard)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.52
country_id: 1668284
description:
2026-01-31 02:41:24 dovecot_login authenticator failed for H=110-25-109-52.adsl.fetnet.net [110.25.109.52]:46860: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
country_id: 1835841
description:
2026-01-31 02:41:36 dovecot_login authenticator failed for H=([175.206.113.91]) [175.206.113.91]:44518: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:41:01 dovecot_login authenticator failed for H=(dFViX2cu) [185.230.124.69]:55326: 535 Incorrect authentication data (set_id=richard)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.162
country_id: 1269750
description:
2026-01-31 02:41:24 dovecot_login authenticator failed for H=([152.52.192.162]) [152.52.192.162]:39300: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:41:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account richard has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:41:28 dovecot_login authenticator failed for H=(XGDZwDTXaZ) [185.230.124.69]:58898: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.66.231
country_id: 3469034
description:
2026-01-31 02:41:39 dovecot_login authenticator failed for H=(industrianaval.fla.gvt.net.br) [187.58.66.231]:58205: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:42:11 dovecot_login authenticator failed for H=(G0UraBx) [185.230.124.69]:64803: 535 Incorrect authentication data (set_id=richard)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.102.122.20
country_id: 2017370
description:
2026-01-31 02:42:13 dovecot_login authenticator failed for H=([94.102.122.20]) [94.102.122.20]:51736: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:42:34 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.198.132.93
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/Tests/Profiler/FileProfilerStorageTest.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:42:36 dovecot_login authenticator failed for H=(hty9H0q) [45.94.31.131]:60552: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.171.27.248
country_id: 1814991
description:
2026-01-31 02:42:21 dovecot_login authenticator failed for H=([116.171.27.248]) [116.171.27.248]:33202: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:42:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account richard has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:43:05 dovecot_login authenticator failed for H=(kkAOPD2RNS) [185.230.124.69]:51642: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:43:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account charlote.ling has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:43:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:43:15 dovecot_login authenticator failed for H=(1e6RKeIh8) [45.94.31.131]:62324: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:43:31 dovecot_login authenticator failed for H=(q5vpqptQ) [185.230.124.69]:53247: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.31.158
country_id: 3017382
description:
2026-01-31 02:44:32 dovecot_login authenticator failed for H=laubervilliers-657-1-93-158.w80-14.abo.wanadoo.fr [80.14.31.158]:39685: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.44.1.113
country_id: 1814991
description:
2026-01-31 02:44:49 dovecot_login authenticator failed for H=([182.44.1.113]) [182.44.1.113]:41734: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 02:44:56 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:22790: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:44:15 dovecot_login authenticator failed for H=(HvNdShhQc) [45.94.31.131]:56111: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:44:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:44:19 dovecot_login authenticator failed for H=(vPBDBzS1s) [185.230.124.69]:54500: 535 Incorrect authentication data (set_id=richard)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-31 02:44:19 H=([64.89.160.15]) [64.89.160.15]:57856 F=<essenas@outlook.com> rejected RCPT <janice@smartcable.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.152.142.83
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&sub=33 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 52.4.193.97
country_id: 6252001
domain: www.gagasanteguh.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/136.0.0.0 Safari/537.36||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:44:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account charlote.ling has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.29.157
country_id: 3865483
description:
2026-01-31 02:44:05 dovecot_login authenticator failed for H=(red.170.233.29.157.ssservicios.com.ar) [170.233.29.157]:39388: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-01-31 02:45:02 dovecot_login authenticator failed for H=(netcomafrica.com) [41.219.149.74]:47668: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:45:14 dovecot_login authenticator failed for H=(hb9eXQiR) [45.94.31.131]:58495: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.116.66
country_id: 1269750
description:
2026-01-31 02:45:34 dovecot_login authenticator failed for H=([182.95.116.66]) [182.95.116.66]:33486: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:45:05 dovecot_login authenticator failed for H=(VfLEDG1) [185.230.124.69]:52606: 535 Incorrect authentication data (set_id=richard)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:45:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account charlote.ling has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:45:16 dovecot_login authenticator failed for H=(AJ6Ph7qg) [185.230.124.69]:53814: 535 Incorrect authentication data (set_id=charlote.ling)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.58.242
country_id: 1835841
description:
2026-01-31 02:45:25 dovecot_login authenticator failed for H=([61.72.101.1]) [61.72.58.242]:38094: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:46:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account charlote.ling has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:46:12 dovecot_login authenticator failed for H=(U2RbCYcvu) [45.94.31.131]:51749: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:46:13 dovecot_login authenticator failed for H=(IAj3Uue) [185.230.124.69]:63979: 535 Incorrect authentication data (set_id=charlote.ling)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 02:46:53 dovecot_login authenticator failed for H=(y9ZzrwcM4e) [158.94.208.110]:51800: 535 Incorrect authentication data (set_id=louiswong@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:47:04 dovecot_login authenticator failed for H=(aQmBq33Bv) [185.230.124.69]:64462: 535 Incorrect authentication data (set_id=charlote.ling)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:47:11 dovecot_login authenticator failed for H=(1FTZbczNF) [45.94.31.131]:53606: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 02:47:17 dovecot_login authenticator failed for H=(fbk5Lry) [158.94.208.110]:55930: 535 Incorrect authentication data (set_id=louiswong@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:47:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account richard has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:47:17 dovecot_login authenticator failed for H=(1TLDyIK) [185.230.124.69]:58934: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:48:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account richard has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:48:06 dovecot_login authenticator failed for H=(dp32dSuGyg) [185.230.124.69]:53389: 535 Incorrect authentication data (set_id=richard)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:48:29 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.78
country_id: 1269750
description:
2026-01-31 02:48:35 dovecot_login authenticator failed for H=(nsg-corporate-186.152.185.122.airtel.in) [182.95.178.78]:33816: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 02:48:05 dovecot_login authenticator failed for H=(yaxexVA) [158.94.208.110]:63916: 535 Incorrect authentication data (set_id=louiswong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:48:11 dovecot_login authenticator failed for H=(0JFuruQnh) [45.94.31.131]:52952: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.190
country_id: 1269750
description:
2026-01-31 02:48:26 dovecot_login authenticator failed for H=([128.185.194.190]) [128.185.194.190]:59450: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 02:49:12 dovecot_login authenticator failed for H=(zuNFzFEo) [158.94.208.110]:58410: 535 Incorrect authentication data (set_id=louiswong@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:49:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:49:13 dovecot_login authenticator failed for H=(urgIizArb) [45.94.31.131]:58585: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:49:30 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:49:32 dovecot_login authenticator failed for H=(3e7WCekuf3) [185.230.124.69]:62601: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:49:08 dovecot_login authenticator failed for H=(uBdvJj) [185.230.124.69]:49570: 535 Incorrect authentication data (set_id=charlote.ling)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:50:13 dovecot_login authenticator failed for H=(bpUcsl7oS) [45.94.31.131]:49448: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:50:16 dovecot_login authenticator failed for H=(Hu3TTBOk) [185.230.124.69]:62229: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.218.45
country_id: 2802361
description:
2026-01-31 02:50:46 dovecot_login authenticator failed for H=(ADMIN) [181.214.218.45]:15157: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:50:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:50:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 02:50:47 dovecot_login authenticator failed for H=(EAqIaA) [158.94.208.110]:57468: 535 Incorrect authentication data (set_id=louiswong@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2026-01-31 02:50:13 dovecot_login authenticator failed for H=([152.52.234.46]) [182.95.176.194]:48684: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:51:09 dovecot_login authenticator failed for H=(YTmZnz) [185.230.124.69]:56964: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.82.211.111
country_id: 2245662
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/Tests/BinaryFileResponseTest.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:51:13 dovecot_login authenticator failed for H=(A172FFk5JW) [45.94.31.131]:53643: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.254
country_id: 6252001
description:
2026-01-31 02:51:28 dovecot_login authenticator failed for H=([209.23.72.254]) [209.23.72.254]:53954: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.220.169.176
country_id: 2017370
description:
2026-01-31 02:51:45 dovecot_login authenticator failed for H=(31-220-169-176.rdtc.ru) [31.220.169.176]:35995: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
country_id: 1835841
description:
2026-01-31 02:52:00 dovecot_login authenticator failed for H=([183.99.89.74]) [183.99.89.74]:58906: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:51:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:51:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 02:51:11 dovecot_login authenticator failed for H=(tPeZupf5p5) [158.94.208.110]:61543: 535 Incorrect authentication data (set_id=louiswong@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
country_id: 1831722
description:
2026-01-31 02:52:09 dovecot_login authenticator failed for H=(dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:58650: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:52:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account charlote.ling has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:52:21 dovecot_login authenticator failed for H=(hknxgbx9sR) [185.230.124.69]:55050: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.205.156
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/clients.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:52:09 dovecot_login authenticator failed for H=(9VHeKtfPN) [185.230.124.69]:65341: 535 Incorrect authentication data (set_id=charlote.ling)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:52:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:52:15 dovecot_login authenticator failed for H=(JRke66UCuG) [45.94.31.131]:49453: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.190.205.59
country_id: 3996063
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/translation/Tests/fixtures/messages.yml HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:53:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account charlote.ling has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:53:11 dovecot_login authenticator failed for H=(2ZNU12yp) [185.230.124.69]:60367: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:53:16 dovecot_login authenticator failed for H=(6bR0rnz) [45.94.31.131]:53637: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.158.205.225
country_id: 1861060
description:
2026-01-31 02:54:48 dovecot_login authenticator failed for H=kd113158205225.ppp-bb.dion.ne.jp [113.158.205.225]:38354: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.255.190.69
country_id: 2017370
description:
2026-01-31 02:54:56 dovecot_login authenticator failed for H=(92x255x190x69.static-business.omsk.ertelecom.ru) [92.255.190.69]:48248: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.51
country_id: 2921044
description:
2026-01-31 02:55:00 dovecot_plain authenticator failed for H=([178.16.52.51]) [178.16.52.51]:59336: 535 Incorrect authentication data (set_id=meemee@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:54:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account charlote.ling has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:54:08 dovecot_login authenticator failed for H=(4zQ2t4B) [185.230.124.69]:64123: 535 Incorrect authentication data (set_id=charlote.ling)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:54:15 dovecot_login authenticator failed for H=(2v8fCK4UO) [45.94.31.131]:59159: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.232.83.3
country_id: 3175395
domain: advisorygroup.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home2/advi3535/public_html/assets||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:55:51 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:55:02 dovecot_login authenticator failed for H=(w5zOIGis3) [185.230.124.69]:54698: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.51
country_id: 2921044
description:
2026-01-31 02:55:06 dovecot_login authenticator failed for H=([178.16.52.51]) [178.16.52.51]:59336: 535 Incorrect authentication data (set_id=meemee@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:55:14 dovecot_login authenticator failed for H=(NYuwNoAK) [45.94.31.131]:62396: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.152.240
country_id: 1861060
domain: wcc.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/woh/wcc.com.my/images||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:56:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.109
country_id: 2186224
description:
2026-01-31 02:56:50 dovecot_login authenticator failed for H=([121.73.169.109]) [121.73.169.109]:55916: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:56:13 dovecot_login authenticator failed for H=(K5fNFAyF) [45.94.31.131]:59195: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.232.83.3
country_id: 3175395
domain: advisorygroup.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2024/index.php||SC:/home2/advi3535/public_html/wp-content||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:56:31 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:56:45 dovecot_login authenticator failed for H=(iHZy69c4h) [185.230.124.69]:58082: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:56:19 dovecot_login authenticator failed for H=(V9vxjee9q) [185.230.124.69]:55066: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:57:11 dovecot_login authenticator failed for H=(hlP7aVo) [185.230.124.69]:65320: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:57:14 dovecot_login authenticator failed for H=(Y2CQjsf) [45.94.31.131]:53385: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 13.220.185.78
country_id: 6252001
domain: mail.usfood.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.7204.23 Safari/537.36||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:57:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:57:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.131
country_id: 1835841
description:
2026-01-31 02:57:11 dovecot_login authenticator failed for H=([1.227.228.131]) [1.227.228.131]:42893: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:58:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:58:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:58:14 dovecot_login authenticator failed for H=(rI0cQY) [45.94.31.131]:58663: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.170
country_id: 99237
description:
2026-01-31 02:58:41 dovecot_login authenticator failed for H=([65.20.251.170]) [65.20.251.170]:57859: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2026-01-31 02:58:54 dovecot_login authenticator failed for H=nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:47910: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:58:03 dovecot_login authenticator failed for H=(pFLofvsdoI) [185.230.124.69]:65504: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:59:14 dovecot_login authenticator failed for H=(H8KkQYcMQ5) [45.94.31.131]:50668: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.39.167.59
country_id: 1814991
description:
2026-01-31 02:59:22 dovecot_login authenticator failed for H=([111.39.167.59]) [111.39.167.59]:44015: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.193.149
country_id: 1643084
description:
2026-01-31 02:59:41 dovecot_login authenticator failed for H=([103.186.193.149]) [103.186.193.149]:49386: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:59:18 dovecot_login authenticator failed for H=(PC1Ud9Zjit) [185.230.124.69]:58295: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:59:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-31 02:59:41 H=([64.89.160.15]) [64.89.160.15]:52631 F=<drdavid00r5@outlook.com> rejected RCPT <roz@af-sb.com>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:59:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:00:17 dovecot_login authenticator failed for H=(mC4bEg5g) [185.230.124.69]:59704: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 03:00:54 dovecot_login authenticator failed for H=(dt5DTp) [45.94.31.131]:52043: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 03:00:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:00:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 03:00:14 dovecot_login authenticator failed for H=(54GIfZK55Y) [45.94.31.131]:61962: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 03:01:14 dovecot_login authenticator failed for H=(jymLPf2m) [45.94.31.131]:52724: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:01:14 dovecot_login authenticator failed for H=(H2bhHa) [185.230.124.69]:60982: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-31 03:01:37 H=([64.89.160.15]) [64.89.160.15]:55847 F=<essenas@outlook.com> rejected RCPT <miya@hmz.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2026-01-31 03:01:22 dovecot_login authenticator failed for H=static-200-105-141-172.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.172]:52810: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2026-01-31 03:01:44 dovecot_login authenticator failed for H=([187.7.85.97]) [201.15.149.254]:59691: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-31 03:02:47 H=(localhost.localdomain) [78.153.140.207]:41966 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:02:05 dovecot_login authenticator failed for H=(8gc6WHTiRK) [185.230.124.69]:50749: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2026-01-31 03:02:45 dovecot_login authenticator failed for H=([83.136.176.12]) [83.136.176.12]:38423: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.122
country_id: 1269750
description:
2026-01-31 03:02:54 dovecot_login authenticator failed for H=([182.95.215.69]) [182.95.230.122]:49942: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 165.90.205.77
country_id: 953987
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/training-details.php?id=898173 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:03:19 dovecot_login authenticator failed for H=(t9KhIgB) [185.230.124.69]:64484: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:04:33 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:04:10 dovecot_login authenticator failed for H=(sbXFgQcxOi) [185.230.124.69]:50497: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:05:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:05:20 dovecot_login authenticator failed for H=(DKnXdvm) [185.230.124.69]:59865: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.117.0.253
country_id: 1835841
description:
2026-01-31 03:05:46 dovecot_login authenticator failed for H=([222.117.0.253]) [222.117.0.253]:37852: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.27.79.215
country_id: 1814991
description:
2026-01-31 03:06:03 dovecot_login authenticator failed for H=(dns58.online.tj.cn) [60.27.79.215]:9680: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:06:10 dovecot_login authenticator failed for H=(VdGnohIeAM) [185.230.124.69]:61102: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:06:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.219.24.104
country_id: 1269750
domain: www.box.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/woh/box.com.my/wp-includes/images/wp-login.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:07:24 dovecot_login authenticator failed for H=(83NF8dZq) [185.230.124.69]:64835: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:08:09 dovecot_login authenticator failed for H=(U7NV1AC) [185.230.124.69]:50525: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.113.167
country_id: 2960313
description:
2026-01-31 03:08:20 dovecot_login authenticator failed for H=(ADMIN) [37.46.113.167]:36174: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 03:08:46 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (scralmook) [87.103.126.54]:63562: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.85.123.4
country_id: 798549
description:
2026-01-31 03:08:48 dovecot_plain authenticator failed for H=(ginges) [92.85.123.4]:60420: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.168
country_id: 2186224
description:
2026-01-31 03:09:37 dovecot_login authenticator failed for H=([121.73.163.168]) [121.73.163.168]:45940: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2026-01-31 03:09:49 dovecot_login authenticator failed for H=(189-108-129-173.customer.tdatabrasil.net.br) [187.8.64.94]:38745: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:09:20 dovecot_login authenticator failed for H=(B6PeCC) [185.230.124.69]:56747: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:10:11 dovecot_login authenticator failed for H=(iwBlnPUO6) [185.230.124.69]:55975: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


