# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:20:36 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65401: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:20:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:20:19 dovecot_login authenticator failed for H=(hpjVc7Lf1F) [165.154.254.163]:50889: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:20:13 dovecot_login authenticator failed for H=(ak8bLhUg) [165.154.235.67]:56979: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.241.150.246
country_id: 2017370
description:
2026-02-02 09:20:34 dovecot_login authenticator failed for H=91-241-150-246-dyn.neotele.com.ru [91.241.150.246]:56946: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:20:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:20:24 dovecot_login authenticator failed for H=(bdvOAhkr1G) [178.16.52.139]:56238: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-02-02 09:20:07 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:34384: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:20:17 dovecot_login authenticator failed for H=(FFCSyds) [158.94.208.175]:61764: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 91.241.150.246
country_id: 2017370
description:
Feb  2 09:20:32 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(91.241.150.246)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:20:06 dovecot_login authenticator failed for H=(GK3PCDI8b) [165.154.217.204]:64144: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.28.55
country_id: 1814991
description:
2026-02-02 09:20:57 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.28.55]:48486: 535 Incorrect authentication data (set_id=akchan@mckd.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:21:02 dovecot_login authenticator failed for H=(MjBU6UdWA) [165.154.217.204]:53711: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2026-02-02 09:21:30 dovecot_login authenticator failed for H=([83.136.176.12]) [83.136.176.12]:35892: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-02 09:21:47 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:42426: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.160.16
country_id: 6252001
description:
2026-02-02 09:21:04 dovecot_login authenticator failed for H=([127.0.0.1]) [70.174.160.16]:58702: 535 Incorrect authentication data (set_id=akchan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:21:15 dovecot_login authenticator failed for H=(xgjxRzSUPe) [165.154.235.67]:61921: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.102
country_id: 1269750
description:
2026-02-02 09:21:31 dovecot_login authenticator failed for H=([182.95.112.102]) [182.95.112.102]:53276: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.196.213.196
country_id: 1835841
description:
2026-02-02 09:21:59 dovecot_login authenticator failed for H=([119.196.213.196]) [119.196.213.196]:41510: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 206.168.34.204
country_id: 6252001
description:
Feb  2 09:21:19 sv3 pure-ftpd[1595289]: (?@206.168.34.204) [INFO] New connection from 206.168.34.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:21:20 dovecot_login authenticator failed for H=(S7Y0Rw97yX) [158.94.208.175]:57265: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:21:22 dovecot_login authenticator failed for H=(el92IgHiO4) [165.154.217.204]:55756: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:21:16 dovecot_login authenticator failed for H=(cX3BhXqp97) [165.154.254.163]:53312: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:21:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58103: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:21:07 dovecot_login authenticator failed for H=(r0JogmsD) [178.16.52.139]:51509: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:21:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:21:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.251.21.148
country_id: 1814991
description:
2026-02-02 09:21:14 dovecot_login authenticator failed for H=(reverse.gdsz.cncnet.net) [58.251.21.148]:53998: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-02-02 09:21:15 H=(localhost.localdomain) [78.153.140.207]:59086 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/commercial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:22:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:22:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:22:19 dovecot_login authenticator failed for H=(O6yILsu) [165.154.217.204]:61806: 535 Incorrect authentication data (set_id=central)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.168.85.91
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=58191523525583 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
country_id: 1835841
description:
2026-02-02 09:22:03 dovecot_login authenticator failed for H=([183.99.89.74]) [183.99.89.74]:41194: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:22:08 dovecot_login authenticator failed for H=(LKodRgvcA) [178.16.52.139]:65015: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:22:22 dovecot_login authenticator failed for H=(4UuXLfAJ2) [158.94.208.175]:53160: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
country_id: 1835841
description:
2026-02-02 09:22:56 dovecot_login authenticator failed for H=([121.178.185.141]) [121.178.185.141]:60662: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:22:14 dovecot_login authenticator failed for H=(nzIBc0sh) [165.154.235.67]:51436: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:22:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51809: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-02-02 09:22:24 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:15794: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:22:13 dovecot_login authenticator failed for H=(OP84cE6y) [165.154.254.163]:60782: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:22:37 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47260: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.243.58
country_id: 1814991
description:
2026-02-02 09:22:46 dovecot_login authenticator failed for H=([218.21.243.58]) [218.21.243.58]:43004: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 121.178.185.141
country_id: 1835841
description:
Feb  2 09:22:54 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(121.178.185.141)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:23:17 dovecot_login authenticator failed for H=(TjG56czwo) [165.154.217.204]:51553: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
country_id: 1814991
description:
2026-02-02 09:23:21 dovecot_login authenticator failed for H=([111.61.177.190]) [111.61.177.190]:30828: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:23:30 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/contact-us.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:23:14 dovecot_login authenticator failed for H=(eCVGsBimsT) [178.16.52.139]:50108: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:23:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50770: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.177.204.4
country_id: 1269750
description:
2026-02-02 09:23:15 dovecot_login authenticator failed for H=([103.177.204.4]) [103.177.204.4]:36647: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:23:13 dovecot_login authenticator failed for H=(hNKCOX) [165.154.235.67]:57455: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 09:23:22 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:60259: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:23:05 dovecot_login authenticator failed for H=(TjriRv) [158.94.208.175]:52688: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 161.142.118.113
country_id: 1733045
description:
[2026-02-02 09:23:10 +0800] info [webmaild] 161.142.118.113 - s-osada@mckd.com.my "GET /cpsess6022420193/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:23:11 dovecot_login authenticator failed for H=(gZxBcVhNV) [165.154.254.163]:63268: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:24:08 dovecot_login authenticator failed for H=(hVLZK4Bl0y) [165.154.254.163]:64449: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:24:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:24:48 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53950: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:24:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60260: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:24:12 dovecot_login authenticator failed for H=(NznGHpuy) [165.154.235.67]:62209: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:24:13 dovecot_login authenticator failed for H=(a3sGtoOgi) [165.154.217.204]:57237: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:24:21 dovecot_login authenticator failed for H=(UpDd8i) [178.16.52.139]:61457: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.239
country_id: 6252001
description:
2026-02-02  9:24:21 278603 [Warning] Aborted connection 278603 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.239' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:24:42 dovecot_login authenticator failed for H=(4qUcx5) [158.94.208.175]:51852: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:26:00 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:25:05 dovecot_login authenticator failed for H=(w1R2EZX) [165.154.254.163]:55634: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:25:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:25:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52571: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.252.141.229
country_id: 2635167
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/bird/16/80/1619979 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:25:20 dovecot_login authenticator failed for H=(dqapeFY6jZ) [178.16.52.139]:52699: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:25:26 dovecot_login authenticator failed for H=(MxjBA08y) [178.16.52.139]:50986: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:25:08 dovecot_login authenticator failed for H=(FVnNVwRKZ1) [165.154.217.204]:62668: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:25:10 dovecot_login authenticator failed for H=(oeOs3rQwPA) [165.154.235.67]:51939: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:25:44 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:26:11 dovecot_login authenticator failed for H=(l6ihqdELn) [158.94.208.175]:58102: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:26:13 dovecot_login authenticator failed for H=(xsedPeUNCl) [178.16.52.139]:56196: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:26:02 dovecot_login authenticator failed for H=(z7FjWIWZ) [165.154.254.163]:60135: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-02 09:26:02 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:44949: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:26:08 dovecot_login authenticator failed for H=(hWeWlxxi7n) [165.154.235.67]:57834: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:26:58 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51230: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:26:07 dovecot_login authenticator failed for H=(9aD1YX6) [165.154.217.204]:51986: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-02-02 09:26:24 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:51100: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:26:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:26:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:26:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:26:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62136: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:27:06 dovecot_login authenticator failed for H=(krPsGaHee) [165.154.235.67]:63006: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:27:37 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50381: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:27:43 dovecot_login authenticator failed for H=(88lfKXUB88) [158.94.208.175]:62188: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-02-02 09:27:46 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:37216: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:27:04 dovecot_login authenticator failed for H=(HdELrlPc) [178.16.52.139]:49245: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:27:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:27:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:27:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:27:18 dovecot_login authenticator failed for H=(k35Cmie) [165.154.254.163]:55432: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.50.0.217
country_id: 1733045
description:
[2026-02-02 09:27:31 +0800] info [webmaild] 60.50.0.217 - horizon@tst-ma.com "POST /cpsess1762340296/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [210.187.4.62] != Current IP Address [60.50.0.217]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:27:04 dovecot_login authenticator failed for H=(1Ab8QjI) [165.154.217.204]:58058: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-02  9:27:13 278744 [Warning] Aborted connection 278744 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:28:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 09:28:02 dovecot_login authenticator failed for H=(eVstLPADF) [69.5.189.21]:51041: 535 Incorrect authentication data (set_id=louiswong@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2026-02-02 09:28:04 dovecot_plain authenticator failed for H=c-73-13-220-220.hsd1.de.comcast.net (ptallof) [73.13.220.220]:39272: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:28:14 dovecot_login authenticator failed for H=(PdYP0G1j2c) [158.94.208.175]:63799: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:28:16 dovecot_login authenticator failed for H=(O7Yg60C3) [165.154.254.163]:62006: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:28:04 dovecot_login authenticator failed for H=(hypmUn2) [165.154.235.67]:52029: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:28:19 dovecot_login authenticator failed for H=(x3YZYKnL) [165.154.217.204]:65014: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:28:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63739: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2026-02-02 09:28:45 dovecot_login authenticator failed for H=([91.73.195.150]) [91.73.195.150]:58009: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-02-02 09:28:09 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:43791: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:28:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:28:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:28:05 dovecot_login authenticator failed for H=(j2GxE8H57A) [178.16.52.139]:50580: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-02-02 09:28:06 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:35740: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.187.98.68
country_id: 2017370
description:
2026-02-02 09:28:52 dovecot_login authenticator failed for H=([46.187.98.68]) [46.187.98.68]:54948: 535 Incorrect authentication data (set_id=postmaster@wohcheong.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 09:29:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michelle-soo@ms-chemicals.net has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:29:09 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53546: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:29:10 dovecot_login authenticator failed for H=(3w1NWQ7Lhu) [178.16.52.139]:63355: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:29:06 dovecot_login authenticator failed for H=(mnWgmq) [158.94.208.175]:64602: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:29:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.12.5.90
country_id: 1605651
description:
[2026-02-02 09:29:15 +0800] info [whostmgrd] 85.12.5.90 - nexus2019 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.105.153.3
country_id: 2017370
description:
2026-02-02 09:29:04 dovecot_login authenticator failed for H=(3.inet153.multi-net.ru) [89.105.153.3]:42549: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:29:05 dovecot_login authenticator failed for H=(9yZOAbvpq) [165.154.235.67]:56906: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:29:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57544: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:29:27 dovecot_login authenticator failed for H=(w0Cf9b5DZT) [178.16.52.139]:59175: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:29:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:29:13 dovecot_login authenticator failed for H=(jL15R6vE) [165.154.254.163]:59966: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 09:29:14 dovecot_login authenticator failed for H=(NMawZn) [69.5.189.21]:61997: 535 Incorrect authentication data (set_id=louiswong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:29:16 dovecot_login authenticator failed for H=(W3BmKT6rG) [165.154.217.204]:53888: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 09:30:23 dovecot_login authenticator failed for H=(eJek4vjJ7) [69.5.189.21]:56973: 535 Incorrect authentication data (set_id=louiswong@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:30:05 dovecot_login authenticator failed for H=(cTI3PE4Ja) [165.154.235.67]:61774: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:30:06 dovecot_login authenticator failed for H=(7sWgX5rHu) [158.94.208.175]:51306: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.243.58
country_id: 1814991
description:
2026-02-02 09:30:09 dovecot_login authenticator failed for H=([218.21.243.58]) [218.21.243.58]:56808: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:30:10 dovecot_login authenticator failed for H=(nau7uv) [165.154.254.163]:64287: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 09:30:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michelle-soo@ms-chemicals.net has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:30:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 09:30:22 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:3876: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:30:13 dovecot_login authenticator failed for H=(mzyeh039hv) [165.154.217.204]:59550: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:30:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:30:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51182: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:30:23 dovecot_login authenticator failed for H=(roFIIXjP7P) [178.16.52.139]:64995: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 09:30:44 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:60925: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:31:15 dovecot_login authenticator failed for H=(w4r7m2i4Ln) [158.94.208.175]:51635: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.26
country_id: 1269750
description:
2026-02-02 09:31:38 dovecot_login authenticator failed for H=(nsg-corporate-247.223.187.122.airtel.in) [122.186.202.26]:60674: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 09:31:11 dovecot_login authenticator failed for H=(vsvqOONTF) [69.5.189.21]:64975: 535 Incorrect authentication data (set_id=louiswong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:31:07 dovecot_login authenticator failed for H=(rrs32w) [165.154.254.163]:64037: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:31:20 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:42180: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:31:03 dovecot_login authenticator failed for H=(bd2fylO) [165.154.217.204]:64053: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:31:07 dovecot_login authenticator failed for H=(h21TOaMgx) [178.16.52.139]:51320: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 09:31:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michelle-soo@ms-chemicals.net has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:31:43 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:31:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60893: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 09:31:02 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:60927: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:31:06 dovecot_login authenticator failed for H=(stVGUx) [165.154.235.67]:49822: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:32:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.122
country_id: 1269750
description:
2026-02-02 09:32:33 dovecot_login authenticator failed for H=([128.185.223.36]) [182.95.178.122]:36618: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:32:37 dovecot_login authenticator failed for H=(6uzLb6G) [165.154.217.204]:61252: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:32:05 dovecot_login authenticator failed for H=(qGaJp5tQOF) [165.154.235.67]:54486: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 09:32:07 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:60947: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:32:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54890: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 09:32:21 dovecot_login authenticator failed for H=(V8wkc3) [69.5.189.21]:60192: 535 Incorrect authentication data (set_id=louiswong@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 09:32:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michelle-soo@ms-chemicals.net has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:32:18 dovecot_login authenticator failed for H=(O8iQmswW) [165.154.217.204]:57108: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.107.130
country_id: 1269750
description:
2026-02-02 09:32:44 dovecot_login authenticator failed for H=([115.244.235.242]) [117.248.107.130]:38956: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:32:02 dovecot_login authenticator failed for H=(vlzbT3v4NI) [178.16.52.139]:60244: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:32:05 dovecot_login authenticator failed for H=(YVErGyHqEo) [165.154.254.163]:54370: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:32:14 dovecot_login authenticator failed for H=(BdbmZHHLP) [158.94.208.175]:51837: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:33:02 dovecot_login authenticator failed for H=(QApBoTGy7k) [165.154.254.163]:61386: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:33:04 dovecot_login authenticator failed for H=(TMf5hFH) [165.154.235.67]:59456: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:33:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63855: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 09:33:09 dovecot_login authenticator failed for H=(eiP0RJ) [69.5.189.21]:52051: 535 Incorrect authentication data (set_id=louiswong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:33:18 dovecot_login authenticator failed for H=(TGkkDACc) [158.94.208.175]:64535: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 09:33:35 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:58009: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:33:38 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44456: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:33:57 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:33:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:33:03 dovecot_login authenticator failed for H=(VZD9AmNL) [178.16.52.139]:53304: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:33:14 dovecot_login authenticator failed for H=(oTFjSfl) [165.154.217.204]:49601: 535 Incorrect authentication data (set_id=central)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.82.53.85
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/css-selector/XPath/TranslatorInterface.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:34:18 dovecot_login authenticator failed for H=(1Ohu3hY) [165.154.254.163]:58111: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:34:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:34:03 dovecot_login authenticator failed for H=(H1QGLUIr) [165.154.235.67]:65406: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:34:07 dovecot_login authenticator failed for H=(lSGvGyI5v) [178.16.52.139]:60368: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.147.102.236
country_id: 99237
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=649112 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:34:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51215: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 09:34:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:50248: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:34:10 dovecot_login authenticator failed for H=(pGoeq3fJ2Z) [165.154.217.204]:54694: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:34:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:34:20 dovecot_login authenticator failed for H=(wrQa1zpk) [158.94.208.175]:59888: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.44.197.37
country_id: 6251999
description:
[2026-02-02 09:35:30 +0800] info [cpaneld] 45.44.197.37 - oxboldc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:35:20 dovecot_login authenticator failed for H=(6b4WlO) [165.154.235.67]:55306: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:35:22 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61088: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:35:15 dovecot_login authenticator failed for H=(vE1EHr) [165.154.254.163]:59397: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:35:48 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53024: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:35:51 dovecot_login authenticator failed for H=(2tBRnKnx7D) [158.94.208.175]:63638: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:35:06 dovecot_login authenticator failed for H=(mHW1uAZ0) [178.16.52.139]:56884: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:35:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2026-02-02 09:35:13 dovecot_login authenticator failed for H=([221.209.48.204]) [221.209.48.203]:53736: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:35:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-02-02 09:35:02 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:55734: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:35:06 dovecot_login authenticator failed for H=(PwtzQtgi) [165.154.217.204]:59592: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 143.20.185.212
country_id: 6252001
description:
2026-02-02 09:36:37 H=([143.20.185.212]) [143.20.185.212]:58164 F=<admin@tst-ma.com> rejected RCPT <mkchong@tst-ma.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-02 09:36:59 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:60406: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:36:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:36:27 dovecot_login authenticator failed for H=(YPeazETnh) [158.94.208.175]:51320: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.246.238
country_id: 1814991
description:
2026-02-02 09:36:32 dovecot_login authenticator failed for H=([218.21.246.238]) [218.21.246.238]:58366: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:36:03 dovecot_login authenticator failed for H=(rgmehXhu) [165.154.217.204]:63928: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:36:12 dovecot_login authenticator failed for H=(aDjHlB) [165.154.254.163]:64007: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-02-02 09:36:45 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:32874: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:36:11 dovecot_login authenticator failed for H=(A1HKPptKa) [178.16.52.139]:50960: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:36:17 dovecot_login authenticator failed for H=(Tj2dWU) [165.154.235.67]:59960: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.162
country_id: 1269750
description:
2026-02-02 09:36:17 dovecot_login authenticator failed for H=(nsg-corporate-162.230.187.122.airtel.in) [122.187.230.162]:45039: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:36:31 dovecot_login authenticator failed for H=(rz8UlUXKg) [165.154.254.163]:53871: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:36:11 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54566: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:36:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:37:16 dovecot_login authenticator failed for H=(NVGC2qoP6) [165.154.235.67]:64542: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:37:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:37:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64575: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:37:10 dovecot_login authenticator failed for H=(kfjAYia0TL) [178.16.52.139]:62900: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-02-02 09:37:59 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:37:03 dovecot_login authenticator failed for H=(r96K19Umrd) [165.154.217.204]:54061: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:37:09 dovecot_login authenticator failed for H=(NZcrEiX) [165.154.254.163]:57280: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-02-02 09:37:43 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:40486: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:37:59 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44366: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:37:07 dovecot_login authenticator failed for H=(BY4cmx) [158.94.208.175]:63260: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:38:05 dovecot_login authenticator failed for H=(eENwbX7) [178.16.52.139]:64398: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:38:10 dovecot_login authenticator failed for H=(2SFahKST) [158.94.208.175]:55162: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:38:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/demos/img/img/new-development.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:38:06 dovecot_login authenticator failed for H=(HpFUuvQ0k) [165.154.254.163]:61172: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:38:17 dovecot_login authenticator failed for H=(rBUQOS) [165.154.235.67]:65389: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:38:19 dovecot_login authenticator failed for H=(ImNCHujnuY) [165.154.217.204]:59919: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 09:38:25 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63528: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:38:47 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56213: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:39:17 dovecot_login authenticator failed for H=(8Rd0mCQoV) [165.154.235.67]:53900: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:39:38 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51170: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:39:15 dovecot_login authenticator failed for H=(4BDi0py) [158.94.208.175]:51280: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.112
country_id: 6252001
description:
Feb  2 09:39:19 sv3 pure-ftpd[1612738]: (?@147.185.132.112) [INFO] New connection from 147.185.132.112


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:39:04 dovecot_login authenticator failed for H=(Vqxlfny) [165.154.254.163]:64982: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:39:52 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2026-02-02 09:39:58 dovecot_plain authenticator failed for H=(pertondfic) [65.20.133.208]:33877: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:39:09 dovecot_login authenticator failed for H=(4Onfk7c1) [178.16.52.139]:62543: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:39:15 dovecot_login authenticator failed for H=(ywGUlxqC) [165.154.217.204]:65419: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.163.215
country_id: 1814991
description:
2026-02-02 09:40:00 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.163.215]:35826: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 09:40:25 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (exingly) [87.103.126.54]:51695: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:40:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60699: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.158.148
country_id: 1814991
description:
2026-02-02 09:40:08 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.158.148]:55274: 535 Incorrect authentication data (set_id=hafizi)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:40:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:40:10 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59850: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:40:15 dovecot_login authenticator failed for H=(eryX8JgC) [165.154.235.67]:58697: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:40:20 dovecot_login authenticator failed for H=(iLs1etU0E7) [165.154.254.163]:62986: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:40:07 dovecot_login authenticator failed for H=(3JeVsPO56z) [178.16.52.139]:51807: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2026-02-02 09:40:37 dovecot_plain authenticator failed for H=c-174-161-27-82.hsd1.tn.comcast.net (feleosed) [174.161.27.82]:43684: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:40:13 dovecot_login authenticator failed for H=(EMEySSfW9) [165.154.217.204]:54210: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:40:18 dovecot_login authenticator failed for H=(1eAjfVkwh) [158.94.208.175]:51512: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.17.91.226
country_id: 1562822
description:
2026-02-02 09:40:58 dovecot_login authenticator failed for H=([103.17.91.226]) [103.17.91.226]:37672: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:40:33 dovecot_login authenticator failed for H=(UAcactoM) [165.154.217.204]:55583: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2026-02-02 09:40:40 dovecot_plain authenticator failed for H=c-73-168-136-150.hsd1.il.comcast.net (hocachine) [73.168.136.150]:42294: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:41:08 dovecot_login authenticator failed for H=(OUoJByWi90) [178.16.52.139]:61236: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:41:17 dovecot_login authenticator failed for H=(73uucs9Qe) [165.154.254.163]:62547: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.255.96.29
country_id: 3175395
description:
2026-02-02 09:41:44 dovecot_plain authenticator failed for H=(unpodyke) [130.255.96.29]:5682: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.181.50.190
country_id: 1835841
description:
[2026-02-02 09:41:49 +0800] info [webmaild] 108.181.50.190 - itdept@ajplantations.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:41:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:41:11 dovecot_login authenticator failed for H=(P0fCEuYrXC) [165.154.217.204]:58721: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:41:14 dovecot_login authenticator failed for H=(eFt1NH) [165.154.235.67]:63869: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:41:17 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54125: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.206
country_id: 1269750
description:
2026-02-02 09:41:22 dovecot_login authenticator failed for H=([182.95.24.19]) [182.95.54.206]:45494: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:41:53 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.246.217
country_id: 3469034
description:
2026-02-02 09:42:33 dovecot_plain authenticator failed for H=([172.16.0.2]) [104.28.246.217]:45783: 535 Incorrect authentication data (set_id=teng@pftfood.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.166.4.141
country_id: 3469034
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/cwd/proc/self/cwd/etc/stats.conf||User:root||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:42:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:42:09 dovecot_login authenticator failed for H=(P68Te5) [165.154.217.204]:63736: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:42:12 dovecot_login authenticator failed for H=(68bf4keJ0) [178.16.52.139]:64996: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:42:14 dovecot_login authenticator failed for H=(XVodM8) [165.154.254.163]:55580: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:42:18 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53858: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:42:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64520: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:42:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:42:13 dovecot_login authenticator failed for H=(W3Dv01U) [165.154.235.67]:52241: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:42:18 dovecot_login authenticator failed for H=(0SlrMAXN) [158.94.208.175]:54303: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.167.202
country_id: 290557
description:
2026-02-02 09:42:28 dovecot_login authenticator failed for H=([91.73.167.202]) [91.73.167.202]:36305: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.246.214
country_id: 3469034
description:
2026-02-02 09:42:44 dovecot_plain authenticator failed for H=([172.16.0.2]) [104.28.246.214]:45843: 535 Incorrect authentication data (set_id=teng@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.15.194.158
country_id: 1814991
description:
2026-02-02 09:42:47 dovecot_login authenticator failed for H=([60.15.194.158]) [60.15.194.158]:47778: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:43:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57586: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:43:11 dovecot_login authenticator failed for H=(WY7WO8) [165.154.254.163]:50143: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:43:12 dovecot_login authenticator failed for H=(Arl7houQL) [165.154.235.67]:56741: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.107
country_id: 6252001
description:
Feb  2 09:43:13 sv3 pure-ftpd[1615618]: (?@205.210.31.107) [INFO] New connection from 205.210.31.107


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.204
country_id: 1880251
description:
2026-02-02 09:43:06 dovecot_login authenticator failed for H=(FZaM7AJ) [165.154.217.204]:52482: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:43:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:43:53 dovecot_login authenticator failed for H=(glzCSL6) [158.94.208.175]:63743: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.217.204
country_id: 1880251
description:
Feb  2 09:43:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account central has been locked for the attacker IP 165.154.217.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.150.100.174
country_id: 2635167
description:
2026-02-02 09:43:04 dovecot_login authenticator failed for H=host86-150-100-174.range86-150.btcentralplus.com [86.150.100.174]:35700: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:43:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2026-02-02 09:43:16 dovecot_login authenticator failed for H=host-24-207-66-154.public.eastlink.ca [24.207.66.154]:44444: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.167
country_id: 2750405
description:
2026-02-02  9:43:40 279391 [Warning] Aborted connection 279391 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.167' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:43:09 dovecot_login authenticator failed for H=(haaDJI) [178.16.52.139]:63717: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 09:43:47 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:59816: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:44:21 dovecot_login authenticator failed for H=(4HOh1Xnj) [178.16.52.139]:57923: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:44:09 dovecot_login authenticator failed for H=(Wfvx0W0c) [165.154.254.163]:63555: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:44:52 dovecot_login authenticator failed for H=(zWOqFRZs) [158.94.208.175]:51257: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:44:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:44:28 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41334: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.249.26.108
country_id: 3469034
domain: hmz.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:98206.hmz.com.my||ServerName:hmz.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:79660365f569b1a51bf8bc304b0d10bf19499adc||Title:0x0ab23712||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:44:38 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61705: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:44:03 dovecot_login authenticator failed for H=(RPRgC0G) [178.16.52.139]:57553: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2026-02-02 09:44:09 dovecot_login authenticator failed for H=(46.30.161.197.access.ipnet.ua) [46.30.161.197]:39059: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 177.6.225.12
country_id: 3469034
domain: hmz.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:15073.hmz.com.my||ServerName:hmz.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:814ab2e3ab39ad41df2823ce455ee43e004143dc||Title:0x7f494742||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.67.121.58
country_id: 1814991
description:
2026-02-02 09:44:31 dovecot_login authenticator failed for H=([124.67.121.58]) [124.67.121.58]:36878: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:44:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:44:11 dovecot_login authenticator failed for H=(W7YQy34A1) [165.154.235.67]:61065: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 09:46:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57406: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:45:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:45:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:45:10 dovecot_login authenticator failed for H=(aqF461) [165.154.235.67]:65264: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:45:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55085: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2026-02-02 09:45:27 dovecot_plain authenticator failed for H=(prulorus) [50.231.243.28]:50634: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:45:28 dovecot_login authenticator failed for H=(RwhMVaWwO5) [158.94.208.175]:51234: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.8.170
country_id: 2017370
description:
2026-02-02 09:45:49 dovecot_plain authenticator failed for H=(outhart) [31.173.8.170]:44932: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-02-02 09:46:00 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:1826: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:45:06 dovecot_login authenticator failed for H=(53nGqgZ) [165.154.254.163]:58784: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:45:13 dovecot_login authenticator failed for H=(Q5hvND8Vt6) [178.16.52.139]:52429: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:46:03 dovecot_login authenticator failed for H=(HAcpon) [158.94.208.175]:53935: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 09:46:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57406: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:46:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.91.153.26
country_id: 3077311
description:
2026-02-02 09:46:11 dovecot_login authenticator failed for H=u153-26.static.grape.cz [93.91.153.26]:41764: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:46:38 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:60412: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/druma_photos/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:46:17 dovecot_login authenticator failed for H=(R1oZKqC) [178.16.52.139]:56743: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:46:12 dovecot_login authenticator failed for H=(NvgfLfv) [165.154.235.67]:53100: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:46:17 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65160: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:46:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:46:03 dovecot_login authenticator failed for H=(2sBsWpke7) [165.154.254.163]:54515: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:47:19 dovecot_login authenticator failed for H=(utNRfabU) [165.154.254.163]:58052: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2026-02-02 09:47:55 dovecot_login authenticator failed for H=([27.123.111.110]) [27.123.111.110]:59980: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:47:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:47:10 dovecot_login authenticator failed for H=(TQ4jNsl) [165.154.235.67]:56854: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:47:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53862: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:47:12 dovecot_login authenticator failed for H=(zACGw5t) [158.94.208.175]:51113: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:47:21 dovecot_login authenticator failed for H=(v8X4WsJ) [178.16.52.139]:61925: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/img/photos/img/photos/blog.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:48:35 dovecot_login authenticator failed for H=(hItBOBtNP) [165.154.254.163]:61343: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:48:15 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49794: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.167
country_id: 2750405
description:
2026-02-02  9:49:01 279656 [Warning] Aborted connection 279656 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.167' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.241.150.246
country_id: 2017370
description:
2026-02-02 09:48:18 dovecot_login authenticator failed for H=91-241-150-246-dyn.neotele.com.ru [91.241.150.246]:56212: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:48:16 dovecot_login authenticator failed for H=(4A0ofG) [165.154.254.163]:52082: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:48:21 dovecot_login authenticator failed for H=(jPX8xmD) [158.94.208.175]:57804: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-02-02 09:48:40 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:40132: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:48:49 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49312: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 103.157.49.19
country_id: 1643084
domain: cabe.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:'-var_dump(md5(244206059))-'||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-02-02 09:48:40 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:55316: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 103.157.49.19
country_id: 1643084
domain: cabe.com.my
description:
IM360 WAF: Special shell symbol in request||MV:@var_dump(md5(407275460)||MVN:ARGS:id||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:48:20 dovecot_login authenticator failed for H=(XBoLrhys) [178.16.52.139]:63011: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.242.61.9
country_id: 1814991
description:
2026-02-02 09:48:27 dovecot_login authenticator failed for H=([114.242.61.9]) [114.242.61.9]:35798: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-02-02 09:48:35 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:56442: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-02-02 09:48:52 dovecot_login authenticator failed for H=(175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:36186: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:48:09 dovecot_login authenticator failed for H=(l16IDJDD) [165.154.235.67]:60994: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.91.153.26
country_id: 3077311
description:
2026-02-02 09:49:55 dovecot_login authenticator failed for H=u153-26.static.grape.cz [93.91.153.26]:42689: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:49:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60560: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:49:14 dovecot_login authenticator failed for H=(9IyhN9d9) [165.154.254.163]:62695: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:49:28 dovecot_login authenticator failed for H=(IGa3rLqjCr) [158.94.208.175]:56370: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:49:08 dovecot_login authenticator failed for H=(xhhuUH) [165.154.235.67]:64649: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-02 09:49:42 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:42665: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:49:50 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:49:22 dovecot_login authenticator failed for H=(PaevuBU) [178.16.52.139]:64689: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:50:07 dovecot_login authenticator failed for H=(NgKYFe1qt) [178.16.52.139]:55772: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:50:09 dovecot_login authenticator failed for H=(i52YUPBU) [165.154.235.67]:51795: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:50:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:50:11 dovecot_login authenticator failed for H=(oPzkmdr4po) [165.154.254.163]:57100: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-02-02 09:50:48 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:58736: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:50:59 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43930: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:50:02 dovecot_login authenticator failed for H=(VyozR66k) [158.94.208.175]:55552: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:50:38 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65225: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2026-02-02 09:51:49 dovecot_login authenticator failed for H=([218.149.235.152]) [218.149.235.152]:36686: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:51:10 dovecot_login authenticator failed for H=(V0s1xgKq) [158.94.208.175]:60322: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:51:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64465: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:51:10 dovecot_login authenticator failed for H=(g4UGKp4hF) [165.154.235.67]:55612: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 211.228.113.27
country_id: 1835841
description:
Feb  2 09:51:51 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(211.228.113.27)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
country_id: 1835841
description:
2026-02-02 09:51:23 dovecot_login authenticator failed for H=([118.36.234.156]) [118.36.234.156]:36196: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-02-02 09:51:04 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:52782: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:51:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(165.154.235.67)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:51:07 dovecot_login authenticator failed for H=(XpawDI) [178.16.52.139]:62143: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:51:08 dovecot_login authenticator failed for H=(kmzr1YDS) [165.154.254.163]:50408: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:51:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-02-02 09:51:47 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:57106: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-02-02 09:51:19 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:44745: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-02-02 09:52:02 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:57729: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:52:05 dovecot_login authenticator failed for H=(y5ejmS5V) [165.154.254.163]:59208: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:52:10 dovecot_login authenticator failed for H=(U2z92H) [165.154.235.67]:59392: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.238.2.7
country_id: 3469034
description:
2026-02-02 09:52:23 dovecot_login authenticator failed for H=45-238-2-7.netmaisfibra.net.br [45.238.2.7]:44180: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:52:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:52:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62453: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:52:46 dovecot_login authenticator failed for H=(AmKaKf) [178.16.52.139]:50187: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:52:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(165.154.235.67)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:52:14 dovecot_login authenticator failed for H=(AarOCDlg) [178.16.52.139]:63266: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.141.233.184
country_id: 1814991
description:
2026-02-02 09:52:11 dovecot_login authenticator failed for H=([117.141.233.184]) [117.141.233.184]:44566: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:52:16 dovecot_login authenticator failed for H=(DMQzVO5) [158.94.208.175]:49629: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:53:03 dovecot_login authenticator failed for H=(WFu2GF6ut) [178.16.52.139]:64520: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 09:53:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.67.248.22
country_id: 6252001
description:
2026-02-02 09:54:00 dovecot_login authenticator failed for H=ip174-67-248-22.oc.oc.cox.net ([127.0.0.1]) [174.67.248.22]:40495: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:53:02 dovecot_login authenticator failed for H=(7o4vTo) [165.154.254.163]:52406: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:53:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56769: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:53:22 dovecot_login authenticator failed for H=(fWRHFgvd5) [158.94.208.175]:56245: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 09:53:26 +0800] info [cpaneld] 185.204.54.153 - nenime "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nenime (has_cpuser_file failed)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:53:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(165.154.235.67)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:53:08 dovecot_login authenticator failed for H=(oqqDEbn) [165.154.235.67]:62695: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:53:09 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46534: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:53:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 09:54:30 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:54:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(165.154.235.67)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:54:08 dovecot_login authenticator failed for H=(had3nh) [165.154.235.67]:49729: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:54:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:54:16 dovecot_login authenticator failed for H=(K0wPTF) [178.16.52.139]:57944: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 09:54:18 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:62960: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:54:19 dovecot_login authenticator failed for H=(CM6v7PKEv) [165.154.254.163]:55182: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:54:32 dovecot_login authenticator failed for H=(FUxttj5) [158.94.208.175]:58420: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:54:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51675: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.253.142
country_id: 1814991
description:
2026-02-02 09:55:18 dovecot_login authenticator failed for H=([116.113.253.142]) [116.113.253.142]:53321: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.99.61.248
country_id: 1269750
description:
2026-02-02 09:55:38 dovecot_login authenticator failed for H=([14.99.61.248]) [14.99.61.248]:46528: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:55:05 dovecot_login authenticator failed for H=(2ONMrxFU) [158.94.208.175]:56305: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2026-02-02 09:55:06 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:37024: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:55:16 dovecot_login authenticator failed for H=(OIYH1MnM49) [165.154.254.163]:65116: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:55:18 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50594: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-02-02 09:55:20 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:48060: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.141.143.58
country_id: 1835841
description:
2026-02-02 09:55:52 dovecot_login authenticator failed for H=([115.141.143.58]) [115.141.143.58]:37283: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 09:55:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:55:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62580: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/about-sinaran-utama-teknologi/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:55:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(165.154.235.67)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:55:06 dovecot_login authenticator failed for H=(7DkbFR) [165.154.235.67]:53316: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 122.186.174.35
country_id: 1269750
description:
Feb  2 09:55:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(122.186.174.35)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:55:20 dovecot_login authenticator failed for H=(rCmpVsazi) [178.16.52.139]:59218: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:56:50 dovecot_login authenticator failed for H=(5jc6Hj) [178.16.52.139]:49486: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:56:04 dovecot_login authenticator failed for H=(ZX8XT7) [165.154.235.67]:56961: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 09:56:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:56:10 dovecot_login authenticator failed for H=(fsFJQzpxLy) [158.94.208.175]:51270: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:56:13 dovecot_login authenticator failed for H=(NECw12bTV) [165.154.254.163]:57848: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:56:41 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65095: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 09:56:48 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michelle.soo@ms-chemicals.net has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 09:56:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(165.154.235.67)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:56:02 dovecot_login authenticator failed for H=(D7xPePWVo) [178.16.52.139]:52136: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.167
country_id: 2750405
description:
2026-02-02  9:57:48 280077 [Warning] Aborted connection 280077 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.167' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 09:57:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michelle.soo@ms-chemicals.net has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:57:48 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:57:02 dovecot_login authenticator failed for H=(AijIsH0) [178.16.52.139]:49227: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-02 09:57:29 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:36340: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-02-02 09:57:55 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:52806: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:57:12 dovecot_login authenticator failed for H=(R4R206HPMp) [165.154.254.163]:65170: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:57:29 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39892: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:57:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61360: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:57:07 dovecot_login authenticator failed for H=(VXJoSMQ6) [165.154.235.67]:60737: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:58:22 dovecot_login authenticator failed for H=(MW8bKxJ0Bk) [158.94.208.175]:63761: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.164.93.136
country_id: 6252001
description:
2026-02-02 09:58:26 dovecot_login authenticator failed for H=([24.164.93.136]) [24.164.93.136]:58388: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:58:05 dovecot_login authenticator failed for H=(aGzEmnKy) [165.154.235.67]:65121: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:58:09 dovecot_login authenticator failed for H=(hgr6nht9) [165.154.254.163]:57248: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.34
country_id: 1269750
description:
2026-02-02 09:58:15 dovecot_login authenticator failed for H=(nsg-corporate-34.230.187.122.airtel.in) [122.187.230.34]:37043: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.10.20
country_id: 1814991
description:
2026-02-02 09:58:21 dovecot_login authenticator failed for H=([221.10.10.20]) [221.10.10.20]:41371: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:58:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:58:12 dovecot_login authenticator failed for H=(YX1t3FMkn) [178.16.52.139]:64232: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:58:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55228: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 09:58:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michelle.soo@ms-chemicals.net has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 09:59:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49939: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 09:59:40 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41476: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 09:59:27 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michelle.soo@ms-chemicals.net has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 09:59:30 dovecot_login authenticator failed for H=(OhNVi9DGUW) [158.94.208.175]:49476: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 09:59:06 dovecot_login authenticator failed for H=(TlxN5U6m5t) [165.154.254.163]:49473: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 09:59:03 dovecot_login authenticator failed for H=(F7CEwo9F) [178.16.52.139]:55037: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 09:59:03 dovecot_login authenticator failed for H=(QLCSwxwEGf) [165.154.235.67]:52293: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 09:59:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 09:59:25 dovecot_login authenticator failed for H=(Dmo8LnKnw) [158.94.208.110]:65221: 535 Incorrect authentication data (set_id=ratanam@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:00:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60859: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 10:00:06 dovecot_login authenticator failed for H=(Ns8whrE86M) [178.16.52.139]:64352: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:00:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:00:34 dovecot_login authenticator failed for H=(XxoLOawO) [158.94.208.175]:52185: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 10:00:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michelle.soo@ms-chemicals.net has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 10:00:36 dovecot_login authenticator failed for H=(rRhOYrJvZH) [178.16.52.139]:52012: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.197.57.71
country_id: 1733045
description:
2026-02-02 10:00:01 H=([127.0.0.1]) [103.197.57.71]:46676 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<etenancy@manforce.my> A=dovecot_plain:etenancy@manforce.my rejected RCPT <manager@example.com>: The mail server could not deliver mail to manager@example.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:00:03 dovecot_login authenticator failed for H=(F6EVCw) [165.154.254.163]:57285: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:00:05 dovecot_login authenticator failed for H=(q4NlGu4Q7) [165.154.235.67]:56239: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-02 10:00:13 dovecot_login authenticator failed for H=(cUPirGE) [158.94.208.110]:56804: 535 Incorrect authentication data (set_id=ratanam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.82
country_id: 1269750
description:
2026-02-02 10:01:57 dovecot_login authenticator failed for H=(nsg-corporate-82.230.187.122.airtel.in) [122.187.230.82]:53118: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:01:04 dovecot_login authenticator failed for H=(YPIbNP) [165.154.235.67]:60223: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:01:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54783: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 10:01:52 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:37082: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:01:06 dovecot_login authenticator failed for H=(Cveh18) [158.94.208.175]:58394: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 10:01:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michelle.soo@ms-chemicals.net has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:01:20 dovecot_login authenticator failed for H=(SwpbGgO6r5) [165.154.254.163]:57725: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 10:01:17 dovecot_login authenticator failed for H=(RzztvPK) [178.16.52.139]:64898: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:01:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:02:06 dovecot_login authenticator failed for H=(Q8NyUzQmA) [165.154.235.67]:64053: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 10:02:17 dovecot_login authenticator failed for H=(Jbahs8m3i) [178.16.52.139]:62397: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.253.142
country_id: 1814991
description:
2026-02-02 10:02:20 dovecot_login authenticator failed for H=([116.113.253.142]) [116.113.253.142]:44181: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.74.12.86
country_id: 1269750
description:
2026-02-02 10:02:58 dovecot_login authenticator failed for H=(nsg-static-193.87.72.182.airtel.in) [182.74.12.86]:60738: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 10:02:06 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57543: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:02:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:02:18 dovecot_login authenticator failed for H=(n5H0gPVdX) [165.154.254.163]:62219: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2026-02-02 10:02:34 dovecot_login authenticator failed for H=(nsg-corporate-226.215.186.122.airtel.in) [122.186.201.62]:33144: 535 Incorrect authentication data (set_id=office@ocned.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-02 10:02:26 H=([167.148.167.71]) [167.148.167.71]:55513 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<newsletter@news.rs-online.com> rejected RCPT <account@hmz.com.my>: SPF: 167.148.167.71 is not allowed to send mail from news.rs-online.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:02:41 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59567: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:02:44 dovecot_login authenticator failed for H=(vU8JZ6U) [158.94.208.175]:62233: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:03:05 dovecot_login authenticator failed for H=(PSz3cCXlBH) [165.154.235.67]:51453: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:03:15 dovecot_login authenticator failed for H=(sdMJTv31) [165.154.254.163]:61759: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.85.164
country_id: 1733045
description:
[2026-02-02 10:03:26 +0800] info [webmaild] 180.75.85.164 - shiyun@pftfood.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-02-02 10:04:02 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:37082: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 10:03:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 10:03:07 dovecot_login authenticator failed for H=(suTtOXf) [178.16.52.139]:51057: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:03:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53629: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.122.202
country_id: 294640
description:
2026-02-02 10:03:35 dovecot_plain authenticator failed for H=(opefoal) [2.55.122.202]:60074: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:03:53 dovecot_login authenticator failed for H=(Yen797O8Sp) [158.94.208.175]:64533: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-02-02 10:04:48 H=(localhost.localdomain) [78.153.140.207]:33444 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 87.103.126.54
country_id: 2264397
description:
Feb  2 10:04:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(87.103.126.54)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:05:02 dovecot_login authenticator failed for H=(FBi9qf3PrK) [158.94.208.175]:63774: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 10:04:05 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55114: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2026-02-02 10:04:07 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:51222: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:04:22 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64851: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
country_id: 1835841
description:
2026-02-02 10:04:53 dovecot_login authenticator failed for H=([121.178.185.141]) [121.178.185.141]:43286: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:04:05 dovecot_login authenticator failed for H=(VodQUb) [165.154.235.67]:55135: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 10:04:12 dovecot_login authenticator failed for H=(ADKkfv3B) [178.16.52.139]:61770: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 10:04:49 dovecot_login authenticator failed for H=(ECWQHAzaY) [178.16.52.139]:65357: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 121.160.166.161
country_id: 1835841
description:
Feb  2 10:04:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(121.160.166.161)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-02-02 10:04:39 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:39620: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 10:04:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 10:04:10 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:23970: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:04:12 dovecot_login authenticator failed for H=(ZDjF8Fk) [165.154.254.163]:64312: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.160.166.161
country_id: 1835841
description:
2026-02-02 10:04:21 dovecot_login authenticator failed for H=([121.160.166.161]) [121.160.166.161]:57734: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:05:46 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:05:09 dovecot_login authenticator failed for H=(8sHLSC) [165.154.254.163]:52770: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:05:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59169: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 10:05:22 dovecot_login authenticator failed for H=(fyO7ai2MVP) [178.16.52.139]:50764: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
country_id: 6252001
description:
2026-02-02 10:05:51 dovecot_plain authenticator failed for H=syn-050-074-136-134.biz.spectrum.com (overd) [50.74.136.134]:55750: 535 Incorrect authentication data (set_id=kendek@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 10:05:19 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:58673: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:05:04 dovecot_login authenticator failed for H=(Va6st1Th) [165.154.235.67]:58603: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.27.33.174
country_id: 6252001
description:
2026-02-02 10:05:47 dovecot_plain authenticator failed for H=c-73-27-33-174.hsd1.fl.comcast.net (miled) [73.27.33.174]:51602: 535 Incorrect authentication data (set_id=kendek@kendek.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 10:05:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-02 10:05:22 H=([167.148.167.71]) [167.148.167.71]:50529 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<newsletter@news.rs-online.com> rejected RCPT <enquiry@hmz.com.my>: SPF: 167.148.167.71 is not allowed to send mail from news.rs-online.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:06:03 dovecot_login authenticator failed for H=(XtsWxOzDvQ) [165.154.235.67]:62609: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:06:07 dovecot_login authenticator failed for H=(13Lcb4) [158.94.208.175]:57205: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 10:07:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michelle.soo@ms-chemicals.net has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 10:06:15 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:34870: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 10:06:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.19.123.92
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/laravel/framework/src/Illuminate/Queue/Jobs HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.51.53.223
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/laravel/framework/src/Illuminate/Queue/Jobs/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:06:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:06:07 dovecot_login authenticator failed for H=(11vkTdH) [165.154.254.163]:55495: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 210.186.161.98
country_id: 1733045
description:
[2026-02-02 10:06:34 +0800] info [webmaild] 210.186.161.98 - jle@ajplantations.com.my "POST /cpsess8140000484/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [115.133.147.159] != Current IP Address [210.186.161.98]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 10:06:09 dovecot_login authenticator failed for H=(cNlmmrUF) [178.16.52.139]:56375: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:06:17 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52920: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-02 10:06:28 H=([167.148.167.71]) [167.148.167.71]:54833 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<newsletter@news.rs-online.com> rejected RCPT <enquiry@smartcable.com.my>: SPF: 167.148.167.71 is not allowed to send mail from news.rs-online.com


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 10:07:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:07:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:07:22 dovecot_login authenticator failed for H=(LmDMXd0jB) [165.154.235.67]:51604: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.100.159.2
country_id: 1835841
description:
2026-02-02 10:07:41 dovecot_login authenticator failed for H=([222.100.159.2]) [222.100.159.2]:49886: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:07:44 dovecot_login authenticator failed for H=(7F0oqrrULq) [158.94.208.175]:51705: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:07:04 dovecot_login authenticator failed for H=(98JEggSz) [165.154.254.163]:59322: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-02-02 10:07:19 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:20138: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-02 10:07:35 H=([167.148.167.71]) [167.148.167.71]:59457 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<newsletter@news.rs-online.com> rejected RCPT <info@astlog.com.my>: SPF: 167.148.167.71 is not allowed to send mail from news.rs-online.com


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 10:07:34 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michelle.soo@ms-chemicals.net has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.63.7.250
country_id: 2921044
description:
2026-02-02 10:07:38 dovecot_plain authenticator failed for H=p5b3f07fa.dip0.t-ipconnect.de (potint) [91.63.7.250]:63631: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 10:07:03 dovecot_login authenticator failed for H=(gQlvWn) [178.16.52.139]:54800: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.93.62.202
country_id: 2017370
description:
2026-02-02 10:07:43 dovecot_login authenticator failed for H=80-93-62-202.vps-ptr.clients.spaceweb.ru [80.93.62.202]:53026: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:07:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64101: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:08:22 dovecot_login authenticator failed for H=(jgErZeO1OX) [165.154.254.163]:50853: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.25.5.69
country_id: 6252001
description:
2026-02-02 10:08:38 dovecot_login authenticator failed for H=([127.0.0.1]) [64.25.5.69]:42906: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-02 10:08:13 H=([167.148.167.71]) [167.148.167.71]:61302 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<newsletter@news.rs-online.com> rejected RCPT <info@mkmetal.com.my>: SPF: 167.148.167.71 is not allowed to send mail from news.rs-online.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:08:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53637: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.203
country_id: 1835841
description:
2026-02-02 10:08:25 dovecot_login authenticator failed for H=([218.156.93.203]) [218.156.93.203]:43936: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.127.122.254
country_id: 3144096
description:
2026-02-02 10:08:32 dovecot_login authenticator failed for H=([127.0.0.1]) [94.127.122.254]:57216: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.238.101.129
country_id: 6251999
description:
2026-02-02 10:08:05 dovecot_login authenticator failed for H=d173-238-101-129.home4.cgocable.net [173.238.101.129]:49616: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.162.215.169
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=97751523517829 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.186.241.102
country_id: 1835841
description:
2026-02-02 10:08:14 dovecot_login authenticator failed for H=([112.186.241.102]) [112.186.241.102]:40020: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:08:19 dovecot_login authenticator failed for H=(Sx4RIj7B4) [165.154.235.67]:56123: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:08:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 10:08:25 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:58472: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:08:45 dovecot_login authenticator failed for H=(FWzSzd3f3) [158.94.208.175]:54915: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 10:08:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michelle.soo@ms-chemicals.net has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 10:08:10 dovecot_login authenticator failed for H=(yEdztJVn) [178.16.52.139]:52862: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 10:08:27 dovecot_login authenticator failed for H=(1jZLkMQ9KQ) [178.16.52.139]:50079: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-02-02 10:08:41 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:44704: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:09:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:09:20 dovecot_login authenticator failed for H=(Vk7SuH) [165.154.254.163]:52670: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:09:24 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64761: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 10:09:25 dovecot_login authenticator failed for H=(MWbMJucKL) [178.16.52.139]:51897: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:09:18 dovecot_login authenticator failed for H=(GUtz450h) [165.154.235.67]:60860: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:09:18 dovecot_login authenticator failed for H=(j3MIdbt) [158.94.208.175]:53819: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 10:09:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michelle.soo@ms-chemicals.net has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 10:10:05 dovecot_login authenticator failed for H=(QmeLoMFi) [178.16.52.139]:53362: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:10:20 dovecot_login authenticator failed for H=(r7zuZC) [165.154.254.163]:54861: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.238.52.68
country_id: 1861060
description:
2026-02-02 10:10:53 dovecot_login authenticator failed for H=(ADMIN) [140.238.52.68]:60360: 535 Incorrect authentication data (set_id=contact@jpack.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:10:57 dovecot_login authenticator failed for H=(EndOqa5Q) [158.94.208.175]:51262: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 10:10:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michelle.soo@ms-chemicals.net has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 10:10:05 +0800] info [cpaneld] 185.204.54.153 - snocvl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user snocvl (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:10:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58916: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:10:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:10:20 dovecot_login authenticator failed for H=(kXE3Mbtk) [165.154.235.67]:49448: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 10:10:42 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44248: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:11:17 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52791: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:11:23 dovecot_login authenticator failed for H=(6KarQCFBjS) [165.154.235.67]:53808: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-02 10:11:33 280558 [Warning] Aborted connection 280558 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.253.175.137
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=211364 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:11:58 dovecot_login authenticator failed for H=(QTWUjnfZV) [158.94.208.175]:60142: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.76.248.54
country_id: 1814991
description:
2026-02-02 10:11:38 dovecot_login authenticator failed for H=([222.76.248.54]) [222.76.248.54]:50424: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-02-02 10:11:50 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:58726: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 10:11:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michelle-soo@ms-chemicals.net has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 10:11:05 dovecot_login authenticator failed for H=(eeeNlFnPaC) [178.16.52.139]:64915: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 10:11:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:11:22 dovecot_login authenticator failed for H=(vpvnBz) [165.154.254.163]:57834: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.237.70.192
country_id: 2661886
description:
2026-02-02 10:11:23 dovecot_login authenticator failed for H=([127.0.0.1]) [194.237.70.192]:51938: 535 Incorrect authentication data (set_id=arts@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.220.32.89
country_id: 2017370
description:
2026-02-02 10:11:30 dovecot_login authenticator failed for H=([127.0.0.1]) [95.220.32.89]:54084: 535 Incorrect authentication data (set_id=arts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:12:21 dovecot_login authenticator failed for H=(vQnMN37) [165.154.254.163]:59820: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 10:12:50 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38656: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:12:59 dovecot_login authenticator failed for H=(qGchtsyw) [165.154.254.163]:56042: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:12:03 dovecot_login authenticator failed for H=(FI7X6t4FN) [165.154.235.67]:56595: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.39.54.94
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/markbaker/complex/classes/src/operations/multiply.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 10:12:09 dovecot_login authenticator failed for H=(CuA1wSjs) [178.16.52.139]:53143: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 10:12:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michelle-soo@ms-chemicals.net has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 10:12:24 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:12:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63161: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.113.114.61
country_id: 3658394
description:
[2026-02-02 10:13:15 +0800] info [cpaneld] 181.113.114.61 - ajplanta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajplanta (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:13:18 dovecot_login authenticator failed for H=(4S1Qqal) [165.154.254.163]:62563: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:13:34 dovecot_login authenticator failed for H=(rl2U6l) [158.94.208.175]:51899: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 162.216.231.98
country_id: 6252001
domain: mckd.com.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.71||T:APACHE||RA:162.216.231.98||TA:162.216.231.98||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:13:54 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/about-sinaran-utama-teknologi/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 10:13:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:13:04 dovecot_login authenticator failed for H=(V644A8w) [165.154.235.67]:61339: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 10:13:08 dovecot_login authenticator failed for H=(4g7skZSO7n) [178.16.52.139]:60828: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 161.142.118.113
country_id: 1733045
description:
[2026-02-02 10:13:31 +0800] info [webmaild] 161.142.118.113 - s-osada@mckd.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:13:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58054: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.154.196
country_id: 1814991
description:
2026-02-02 10:14:31 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.154.196]:45329: 535 Incorrect authentication data (set_id=imax123)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 10:14:59 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:40288: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:14:29 dovecot_login authenticator failed for H=(1a6CtYc) [158.94.208.175]:50289: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 35.189.199.133
country_id: 2802361
description:
2026-02-02 10:14:12 280653 [Warning] Aborted connection 280653 to db: 'unconnected' user: 'unauthenticated' host: '35.189.199.133' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 10:14:09 dovecot_login authenticator failed for H=(hON0jiuzHs) [178.16.52.139]:63259: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.190.6.122
country_id: 2017370
description:
2026-02-02 10:14:23 dovecot_login authenticator failed for H=([127.0.0.1]) [94.190.6.122]:48876: 535 Incorrect authentication data (set_id=imax123@imax.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:14:15 dovecot_login authenticator failed for H=(GsRCoB) [165.154.254.163]:64541: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 10:14:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 57.129.69.52
country_id: 2921044
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/img/demos/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:14:22 dovecot_login authenticator failed for H=(17jCgnC1Oc) [165.154.235.67]:50870: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:14:32 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52331: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-02-02 10:14:35 H=(localhost.localdomain) [78.153.140.207]:60106 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:14:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:15:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63706: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 10:15:06 dovecot_login authenticator failed for H=(P9KBEdm) [178.16.52.139]:63896: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 10:15:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2026-02-02 10:15:52 dovecot_login authenticator failed for H=([222.120.176.6]) [222.120.176.6]:60642: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:15:01 dovecot_login authenticator failed for H=(1OZYqTo7) [165.154.235.67]:54108: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:15:13 dovecot_login authenticator failed for H=(yLFHT2X) [165.154.254.163]:49479: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-02-02 10:16:02 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:57844: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:15:05 dovecot_login authenticator failed for H=(08624If) [158.94.208.175]:58590: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:15:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:16:11 dovecot_login authenticator failed for H=(LSBl3X2Y8a) [165.154.254.163]:51107: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 10:16:13 dovecot_login authenticator failed for H=(X66saR6k) [178.16.52.139]:62745: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-02-02 10:16:13 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:43145: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:16:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:16:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58285: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 10:16:42 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:52766: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:16:04 dovecot_login authenticator failed for H=(77jbHbhwk) [165.154.235.67]:59259: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:16:15 dovecot_login authenticator failed for H=(81FaU2iYu8) [158.94.208.175]:50867: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:17:04 dovecot_login authenticator failed for H=(roDMvNeyC) [165.154.235.67]:63930: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:17:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.233.190
country_id: 1835841
description:
2026-02-02 10:17:46 dovecot_login authenticator failed for H=([106.10.69.50]) [183.108.233.190]:34195: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:17:14 dovecot_login authenticator failed for H=(ndrT5ro6a) [158.94.208.175]:61509: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:17:24 dovecot_login authenticator failed for H=(ksFBXXa) [165.154.235.67]:65397: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
country_id: 1835841
description:
2026-02-02 10:17:50 dovecot_login authenticator failed for H=([211.223.41.90]) [211.223.41.90]:44940: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 10:17:07 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43154: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 10:17:09 dovecot_login authenticator failed for H=(oVpXhe6eh) [178.16.52.139]:52828: 535 Incorrect authentication data (set_id=michelle-soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:17:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52057: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:17:09 dovecot_login authenticator failed for H=(FZmLdSulP) [165.154.254.163]:52973: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-02-02 10:18:00 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:21002: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:18:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2026-02-02 10:18:39 dovecot_plain authenticator failed for H=c-73-137-7-97.hsd1.ga.comcast.net (analumily) [73.137.7.97]:60510: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 143.20.185.212
country_id: 6252001
description:
2026-02-02 10:18:57 H=([143.20.185.212]) [143.20.185.212]:50803 F=<admin@oxbold.com> rejected RCPT <steven@oxbold.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.181
country_id: 2215636
description:
2026-02-02 10:18:36 dovecot_plain authenticator failed for H=(artantst) [102.38.3.181]:59708: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-02 10:18:10 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:55349: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:18:13 dovecot_login authenticator failed for H=(phKRCLq) [158.94.208.175]:60191: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:18:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60555: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:18:04 dovecot_login authenticator failed for H=(Xru2NUgM) [165.154.235.67]:52196: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:18:08 dovecot_login authenticator failed for H=(oNOsxKVzYW) [165.154.254.163]:54995: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 10:18:18 dovecot_login authenticator failed for H=(OTiusytrzQ) [178.16.52.139]:59189: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.67.45.29
country_id: 2661886
description:
2026-02-02 10:18:36 dovecot_plain authenticator failed for H=213-67-45-29-no600.tbcn.telia.com (nobil) [213.67.45.29]:57380: 535 Incorrect authentication data (set_id=seanlee@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:19:07 dovecot_login authenticator failed for H=(FZkpriWsd4) [165.154.235.67]:56857: 535 Incorrect authentication data (set_id=admin@solidfence.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-02-02 10:19:19 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:53709: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 10:19:38 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:48388: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.187
country_id: 1269750
description:
2026-02-02 10:19:39 dovecot_login authenticator failed for H=(nsg-corporate-187.230.187.122.airtel.in) [122.187.230.187]:49524: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:19:07 dovecot_login authenticator failed for H=(knl5LXzcoh) [165.154.254.163]:56832: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:19:22 dovecot_login authenticator failed for H=(aI41PnnL7) [158.94.208.175]:53400: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 10:19:25 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@solidfence.com.my has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:19:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65387: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2026-02-02 10:19:33 dovecot_login authenticator failed for H=(46.30.161.197.access.ipnet.ua) [46.30.161.197]:46347: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 10:19:10 dovecot_login authenticator failed for H=(RhqHgj) [178.16.52.139]:54799: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:20:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60004: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:20:24 dovecot_login authenticator failed for H=(ffBJUFTE5q) [158.94.208.175]:60654: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:20:08 dovecot_login authenticator failed for H=(v8tYGO53Z) [165.154.235.67]:61515: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 10:20:22 dovecot_login authenticator failed for H=(ViNMXdbUP4) [178.16.52.139]:63724: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:20:04 dovecot_login authenticator failed for H=(et2rpD) [165.154.254.163]:58058: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-02 10:21:02 280892 [Warning] Aborted connection 280892 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:21:07 dovecot_login authenticator failed for H=(5SlAcm) [165.154.235.67]:49934: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:21:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54383: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.242.203.14
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=9071 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:21:56 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 10:21:47 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55766: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:21:26 dovecot_login authenticator failed for H=(J2kI1k) [158.94.208.175]:49164: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 10:21:08 dovecot_login authenticator failed for H=(c8wO5Cadd) [178.16.52.139]:62788: 535 Incorrect authentication data (set_id=michelle.soo@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:21:20 dovecot_login authenticator failed for H=(BMaC24LgZf) [165.154.254.163]:64212: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:21:39 dovecot_login authenticator failed for H=(6hKVezTb) [165.154.254.163]:53271: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:22:30 dovecot_login authenticator failed for H=(8RQnOc1P7K) [158.94.208.175]:56993: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.96.29.14
country_id: 1269750
description:
2026-02-02 10:22:48 dovecot_login authenticator failed for H=([14.96.29.14]) [14.96.29.14]:46912: 535 Incorrect authentication data (set_id=postmaster@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 10:23:00 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:22:04 dovecot_login authenticator failed for H=(mvPcfnju) [165.154.235.67]:54653: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:22:15 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64731: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:22:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:22:17 dovecot_login authenticator failed for H=(oPUKcZdIQy) [165.154.254.163]:64409: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:23:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 121.142.146.167
country_id: 1835841
description:
Feb  2 10:23:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(121.142.146.167)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 116.75.218.103
country_id: 1269750
description:
Feb  2 10:23:46 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(116.75.218.103)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 10:23:57 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44674: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-02 10:23:38 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:33334: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:23:03 dovecot_login authenticator failed for H=(r1DJqmag) [158.94.208.175]:58963: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:23:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59349: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.160.166.161
country_id: 1835841
description:
2026-02-02 10:23:05 dovecot_login authenticator failed for H=([121.160.166.161]) [121.160.166.161]:36124: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:23:14 dovecot_login authenticator failed for H=(m0mA5e) [165.154.254.163]:65111: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 10:23:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2026-02-02 10:23:27 dovecot_login authenticator failed for H=([197.219.208.38]) [197.219.208.38]:56798: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.14.192.20
country_id: 1835841
description:
2026-02-02 10:23:36 dovecot_login authenticator failed for H=([110.14.192.20]) [110.14.192.20]:58812: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.214.127.246
country_id: 1814991
description:
2026-02-02 10:23:05 dovecot_login authenticator failed for H=([60.214.127.246]) [60.214.127.246]:58835: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.187.154
country_id: 1269750
description:
2026-02-02 10:23:10 dovecot_login authenticator failed for H=([113.193.187.154]) [113.193.187.154]:54020: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
country_id: 1269750
description:
2026-02-02 10:23:48 dovecot_login authenticator failed for H=([103.55.89.5]) [116.75.218.103]:45944: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:23:02 dovecot_login authenticator failed for H=(8dNj2WNQ) [165.154.235.67]:58865: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-02-02 10:23:22 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:56113: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2026-02-02 10:23:30 dovecot_login authenticator failed for H=([103.133.175.82]) [103.142.184.55]:49202: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.255.207.34
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=852424 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 10:24:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:24:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56649: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:24:02 dovecot_login authenticator failed for H=(sCv5RLPbWK) [165.154.235.67]:63163: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:24:08 dovecot_login authenticator failed for H=(qheQs3i) [158.94.208.175]:51733: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:24:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:24:11 dovecot_login authenticator failed for H=(neB8qSw) [165.154.254.163]:49448: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 10:25:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:25:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53052: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:26:01 dovecot_login authenticator failed for H=(ZUzfapspxt) [165.154.235.67]:55509: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:25:08 dovecot_login authenticator failed for H=(UcelQiXRa) [165.154.254.163]:49779: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:25:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:25:56 dovecot_login authenticator failed for H=(ZfWqEDQke) [158.94.208.175]:54020: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:25:03 dovecot_login authenticator failed for H=(GmCX86TMW) [165.154.235.67]:51480: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 10:26:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.95.101.182
country_id: 3469034
description:
2026-02-02 10:26:26 dovecot_login authenticator failed for H=(182.101.95.187.dynamic.liggatelecom.com.br) [187.95.101.182]:39058: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.159.99.193
country_id: 6252001
description:
2026-02-02 10:26:28 dovecot_plain authenticator failed for H=(pirly) [192.159.99.193]:60702: 535 Incorrect authentication data (set_id=mhisham.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.133.2
country_id: 6252001
description:
2026-02-02 10:26:53 dovecot_login authenticator failed for H=syn-024-097-133-002.biz.spectrum.com [24.97.133.2]:54704: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-02-02 10:26:53 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:58848: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:26:17 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63692: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2026-02-02 10:26:05 dovecot_login authenticator failed for H=nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:46949: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:26:32 dovecot_login authenticator failed for H=(jXnnN4N) [158.94.208.175]:61852: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:26:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:26:20 dovecot_login authenticator failed for H=(636UEE543s) [165.154.235.67]:56958: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:26:05 dovecot_login authenticator failed for H=(AHqpwdJGmc) [165.154.254.163]:50707: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 10:26:08 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57242: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 180.188.253.150
country_id: 1269750
description:
Feb  2 10:27:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(180.188.253.150)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-02-02 10:27:07 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:38512: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-02-02 10:27:08 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:53170: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:27:19 dovecot_login authenticator failed for H=(w8TAjxmZ) [165.154.235.67]:60997: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.220.122
country_id: 1269750
description:
2026-02-02 10:27:54 dovecot_plain authenticator failed for H=(P756S1ACH72QLPV) [103.109.220.122]:59911: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 10:27:43 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:60055: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:27:02 dovecot_login authenticator failed for H=(CHzJOzL) [165.154.254.163]:50503: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:27:04 dovecot_login authenticator failed for H=(sZ4UEd) [158.94.208.175]:52341: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:27:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59414: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 10:27:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.220.122
country_id: 1269750
description:
2026-02-02 10:28:02 dovecot_login authenticator failed for H=(P756S1ACH72QLPV) [103.109.220.122]:59911: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:28:17 dovecot_login authenticator failed for H=(R5J73gl75) [165.154.235.67]:65167: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:28:19 dovecot_login authenticator failed for H=(gRsyUOpnq) [165.154.254.163]:56374: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:28:12 dovecot_login authenticator failed for H=(buBAyZlqb) [158.94.208.175]:56604: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.167
country_id: 690791
description:
2026-02-02 10:28:16 H=([77.83.39.167]) [77.83.39.167]:50256 F=<stevenwelboun@op.pl> rejected RCPT <cky@ahfengineering.com>: SPF: 77.83.39.167 is not allowed to send mail from op.pl


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:28:16 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53643: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 10:28:19 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:45538: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-02-02 10:29:02 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:48375: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.70.142
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=463727 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.165
country_id: 99237
description:
2026-02-02 10:28:18 dovecot_plain authenticator failed for H=(cycious) [65.20.148.165]:36517: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.126.53.11
country_id: 1835841
description:
2026-02-02 10:28:42 dovecot_login authenticator failed for H=([168.126.53.11]) [168.126.53.11]:47494: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:29:15 dovecot_login authenticator failed for H=(8DrFiJw) [165.154.235.67]:53189: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:29:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64949: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.66.184.120
country_id: 2017370
description:
2026-02-02 10:29:38 dovecot_login authenticator failed for H=([127.0.0.1]) [77.66.184.120]:55696: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:29:16 dovecot_login authenticator failed for H=(CGlEZzJ) [165.154.254.163]:56713: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.140.54
country_id: 1269750
description:
2026-02-02 10:29:41 dovecot_login authenticator failed for H=([125.21.194.121]) [125.23.140.54]:48488: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.109.38.143
country_id: 6252001
description:
2026-02-02 10:29:54 dovecot_login authenticator failed for H=143.38.109.208.host.secureserver.net [208.109.38.143]:36554: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.0.178.243
country_id: 3175395
description:
2026-02-02 10:29:44 dovecot_login authenticator failed for H=net-130-0-178-243.cust.vodafonedsl.it ([127.0.0.1]) [130.0.178.243]:8224: 535 Incorrect authentication data (set_id=marina)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:29:52 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.25.212
country_id: 1814991
description:
2026-02-02 10:30:14 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.25.212]:43007: 535 Incorrect authentication data (set_id=user@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 10:30:28 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:37844: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:30:03 dovecot_login authenticator failed for H=(nnuUPCj) [158.94.208.175]:64251: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:30:32 dovecot_login authenticator failed for H=(PwqTNo) [165.154.254.163]:61741: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 196.47.172.253
country_id: 2287781
description:
Feb  2 10:30:58 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(196.47.172.253)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-02 10:30:42 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:51710: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:30:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:30:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50690: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-02-02 10:31:00 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:57637: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.94.109.31
country_id: 6252001
description:
2026-02-02 10:30:22 dovecot_login authenticator failed for H=vmi3028831.contaboserver.net ([127.0.0.1]) [66.94.109.31]:39714: 535 Incorrect authentication data (set_id=user)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:30:13 dovecot_login authenticator failed for H=(JcB27eH) [165.154.254.163]:56312: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 10:30:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57788: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:30:17 dovecot_login authenticator failed for H=(SfLVRvm90P) [165.154.235.67]:57398: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:31:38 dovecot_login authenticator failed for H=(BHzGuL) [158.94.208.175]:57471: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 173.25.186.130
country_id: 6252001
description:
Feb  2 10:31:39 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(173.25.186.130)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 10:31:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 91.72.153.110
country_id: 290557
description:
Feb  2 10:31:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(91.72.153.110)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2026-02-02 10:31:23 dovecot_login authenticator failed for H=([91.72.153.110]) [91.72.153.110]:52725: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2026-02-02 10:31:41 dovecot_login authenticator failed for H=(173-25-186-130.client.mchsi.com) [173.25.186.130]:58257: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:31:11 dovecot_login authenticator failed for H=(HspNz2) [165.154.254.163]:56045: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:31:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61329: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:31:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:31:17 dovecot_login authenticator failed for H=(OXQRiYn) [165.154.235.67]:62184: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:32:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 10:32:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:32:09 dovecot_login authenticator failed for H=(KCrU4zF) [165.154.254.163]:56150: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:32:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55783: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:32:15 dovecot_login authenticator failed for H=(r8iCZGy) [165.154.235.67]:58786: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.120.160.142
country_id: 1210997
description:
2026-02-02 10:32:40 dovecot_plain authenticator failed for H=(T8FWR3M6R) [103.120.160.142]:58286: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 10:32:42 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:40668: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:33:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64362: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 10:33:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-02-02 10:33:27 +0800] info [webmaild] 180.75.72.60 - salesadmin@smartcable.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-02-02 10:33:51 dovecot_login authenticator failed for H=(azteca-comunicaciones.com) [201.46.124.0]:2150: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:33:11 dovecot_login authenticator failed for H=(wueRH0) [165.154.254.163]:57308: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:33:17 dovecot_login authenticator failed for H=(q9SuVa) [158.94.208.175]:65509: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:33:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:33:14 dovecot_login authenticator failed for H=(s1KqT6vjf) [165.154.235.67]:65443: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 10:34:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:34:20 dovecot_login authenticator failed for H=(vYfijpjt8G) [165.154.235.67]:53708: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:34:23 dovecot_login authenticator failed for H=(lh8yv3yC) [158.94.208.175]:54777: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.61.48.234
country_id: 1835841
description:
2026-02-02 10:34:12 dovecot_login authenticator failed for H=([125.61.36.27]) [125.61.48.234]:45114: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:34:14 dovecot_login authenticator failed for H=(IKbYrQahly) [165.154.254.163]:58191: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.54.180.181
country_id: 1562822
description:
2026-02-02 10:34:24 dovecot_plain authenticator failed for H=(9b1we7f0h8vy8t8qbfg2aiy4iehgk3) [1.54.180.181]:34939: 535 Incorrect authentication data (set_id=fasya@pftfood.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:34:39 dovecot_login authenticator failed for H=(BY2njPHP) [165.154.235.67]:55415: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 10:34:51 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:37402: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:34:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58856: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:34:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2026-02-02 10:34:17 dovecot_plain authenticator failed for H=c-98-227-25-115.hsd1.il.comcast.net (syndinders) [98.227.25.115]:58648: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.241.202.216
country_id: 6252001
description:
2026-02-02 10:34:25 dovecot_plain authenticator failed for H=cm-72-241-202-216.buckeyecom.net (colles) [72.241.202.216]:57815: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:35:04 dovecot_login authenticator failed for H=(G0VoJOsS8F) [158.94.208.175]:63163: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:35:19 dovecot_login authenticator failed for H=(Lt54r8vck2) [165.154.235.67]:59060: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:35:15 dovecot_login authenticator failed for H=(poYfSpjkvv) [165.154.254.163]:58514: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.235.67
country_id: 6252001
description:
Feb  2 10:35:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 165.154.235.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
country_id: 1814991
description:
2026-02-02 10:35:32 dovecot_login authenticator failed for H=([116.114.94.242]) [116.114.94.242]:57158: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:35:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53547: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-02-02 10:35:06 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:3803: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.106.41.24
country_id: 3469034
description:
2026-02-02 10:37:01 dovecot_plain authenticator failed for H=(P1G39) [187.106.41.24]:19959: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 10:37:02 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41202: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.108.87.131
country_id: 3932488
description:
2026-02-02 10:37:02 dovecot_plain authenticator failed for H=(8N8LN255TCKTWN) [190.108.87.131]:60240: 535 Incorrect authentication data (set_id=project@tujusetia.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 8.219.115.240
country_id: 1880251
description:
[2026-02-02 10:36:09 +0800] info [cpaneld] 8.219.115.240 - kimmark "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:36:12 dovecot_login authenticator failed for H=(nA7TOQ9) [165.154.254.163]:58374: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:36:18 dovecot_login authenticator failed for H=(DTDVlO0B5) [165.154.235.67]:63874: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:36:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57681: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:37:09 dovecot_login authenticator failed for H=(R1oWrl) [165.154.254.163]:57567: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.106.41.24
country_id: 3469034
description:
2026-02-02 10:37:08 dovecot_login authenticator failed for H=(P1G39) [187.106.41.24]:19959: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:37:11 dovecot_login authenticator failed for H=(reE4EMcuY) [158.94.208.175]:60995: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:37:17 dovecot_login authenticator failed for H=(8236FdukO) [165.154.235.67]:52227: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:37:22 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52146: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.108.87.131
country_id: 3932488
description:
2026-02-02 10:37:09 dovecot_login authenticator failed for H=(8N8LN255TCKTWN) [190.108.87.131]:60240: 535 Incorrect authentication data (set_id=project@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:38:08 dovecot_login authenticator failed for H=(sEzxf6wug) [165.154.254.163]:57506: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:38:18 dovecot_login authenticator failed for H=(PCvDB3) [165.154.235.67]:57347: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:38:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58895: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:38:21 dovecot_login authenticator failed for H=(x9Nf7SE) [158.94.208.175]:63715: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:38:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:39:24 dovecot_login authenticator failed for H=(9JfG6gjjcu) [165.154.254.163]:62187: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:40:00 dovecot_login authenticator failed for H=(dqATubhR7) [158.94.208.175]:63640: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:39:05 dovecot_login authenticator failed for H=(vX5KQUki) [165.154.254.163]:57077: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 10:39:12 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41194: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 10:39:26 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:50785: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-02-02 10:39:43 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:55062: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:39:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54371: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.159.71.249
country_id: 1835841
description:
2026-02-02 10:39:16 dovecot_login authenticator failed for H=([121.159.71.249]) [121.159.71.249]:51608: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.136.194.132
country_id: 2017370
description:
2026-02-02 10:39:56 dovecot_login authenticator failed for H=(79x136x194x132.dynamic.saratov.ertelecom.ru) [79.136.194.132]:50678: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.67
country_id: 6252001
description:
2026-02-02 10:39:19 dovecot_login authenticator failed for H=(YfFFPFvOsl) [165.154.235.67]:62155: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 64.72.74.162
country_id: 6252001
description:
Feb  2 10:39:41 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(64.72.74.162)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:39:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.69
country_id: 1668284
description:
2026-02-02 10:40:04 dovecot_login authenticator failed for H=110-25-109-69.adsl.fetnet.net [110.25.109.69]:57708: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.228.244.125
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=749224 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:40:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:40:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65532: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:40:30 dovecot_login authenticator failed for H=(klX6ZPf) [158.94.208.175]:53816: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.162.13.192
country_id: 1562822
domain: www.agsaintifik.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.agsaintifik.com.my/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:40:05 dovecot_login authenticator failed for H=(EmUv17B5) [165.154.254.163]:55824: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.78
country_id: 1269750
description:
2026-02-02 10:41:02 dovecot_login authenticator failed for H=(nsg-corporate-186.152.185.122.airtel.in) [182.95.178.78]:46792: 535 Incorrect authentication data (set_id=contacto@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.136
country_id: 2017370
description:
2026-02-02 10:41:25 dovecot_login authenticator failed for H=([178.178.194.136]) [178.178.194.136]:54660: 535 Incorrect authentication data (set_id=contacto)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.113
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/test.php||SC:/home2/cofrethcom/public_html/images/test.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:41:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59903: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.47.138.157
country_id: 6252001
description:
2026-02-02 10:41:17 dovecot_login authenticator failed for H=(136-47-138-157.googlefiber.net) [136.47.138.157]:42322: 535 Incorrect authentication data (set_id=contacto@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 10:41:25 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35760: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:41:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:41:03 dovecot_login authenticator failed for H=(JEqUkylWY) [165.154.254.163]:50229: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: modsec
rule: 77896900
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 152.42.168.133
country_id: 1880251
domain: www.ahfengineering.com
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wpadminerlzp||User:ahfe3522||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:41:33 dovecot_login authenticator failed for H=(bfcZ6RWg8j) [158.94.208.175]:60590: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:42:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59674: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:42:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.191.214.213
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/css-selector/Tests/Node/CombinedSelectorNodeTest.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:42:06 dovecot_login authenticator failed for H=(z1HPsCFwI3) [158.94.208.175]:60861: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.185.173.167
country_id: 1814991
description:
2026-02-02 10:42:30 dovecot_login authenticator failed for H=([110.185.173.167]) [110.185.173.167]:51798: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-02-02 10:42:58 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:21297: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.222.61.162
country_id: 99237
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=25581516693936 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2026-02-02 10:42:46 dovecot_login authenticator failed for H=([27.123.114.190]) [27.123.114.190]:50456: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:42:04 dovecot_login authenticator failed for H=(trnwFGnOc8) [165.154.254.163]:62577: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:43:24 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59859: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:43:34 dovecot_login authenticator failed for H=(VrHxd8SJaF) [158.94.208.175]:56442: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.117
country_id: 1814991
description:
2026-02-02 10:43:52 dovecot_login authenticator failed for H=([111.61.175.117]) [111.61.175.117]:36804: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:43:04 dovecot_login authenticator failed for H=(CXjZ0BE) [165.154.254.163]:58852: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 10:43:42 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49204: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:43:43 dovecot_login authenticator failed for H=(GOXupQi) [165.154.254.163]:49831: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 111.61.175.117
country_id: 1814991
description:
Feb  2 10:43:50 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account admin has been temporarily locked by Imunify PAM(111.61.175.117)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:44:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54083: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.255.151.130
country_id: 3144096
description:
[2026-02-02 10:44:54 +0800] info [webmaild] 178.255.151.130 - central@agpc.org.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.239.214.50
country_id: 6252001
description:
[2026-02-02 10:44:55 +0800] info [cpaneld] 173.239.214.50 - afcmalaysia "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afcmalaysia (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:44:03 dovecot_login authenticator failed for H=(7FBqzJ) [165.154.254.163]:53698: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:44:08 dovecot_login authenticator failed for H=(lQ6qEiAssY) [158.94.208.175]:54561: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
2026-02-02 10:45:48 1vmjwg-000000072Tf-08v8 <= <> H=165.193.32.34.bc.googleusercontent.com ([10.88.0.4]) [34.32.193.165]:33418 P=esmtp S=5845 T="Authentication Error" for wmchan@nexuscollection.com


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 45.84.107.222
country_id: 2661886
domain: geminiflourmill.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:103341||Sizes:73||Combined size:73||User:cabecom||WPU:||Filename:.htaccess||Scanned:/tmp//20260202-104525-aYAPxd33-lcFov3S2vgSwQAAABA-file-M9F4Uj||SC:/home2/cabecom/public_html/contact.php||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.84.107.222
country_id: 2661886
domain: geminiflourmill.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/uploads/doc.phtml?path=./||SC:/home2/cabecom/public_html/uploads||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:45:02 dovecot_login authenticator failed for H=(nKgkrmX) [165.154.254.163]:64868: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:45:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64538: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 45.84.107.222
country_id: 2661886
domain: geminiflourmill.com
description:
IM360 WAF: Track file upload for Infectors||RSV:7.71||T:APACHE||SC:/home2/cabecom/public_html/contact.php||User:cabecom||WPU:||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 10:45:54 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:33765: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 10:45:54 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50668: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:45:13 dovecot_login authenticator failed for H=(52f4AWtmLz) [158.94.208.175]:50364: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 192.42.116.195
country_id: 2750405
domain: geminiflourmill.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/doc.phtml?path=./||SC:/home2/cabecom/public_html/img/doc.phtml||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:46:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59430: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:46:17 dovecot_login authenticator failed for H=(w2TZWaAsY) [158.94.208.175]:52088: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:46:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.243.58
country_id: 1814991
description:
2026-02-02 10:46:40 dovecot_login authenticator failed for H=([218.21.243.58]) [218.21.243.58]:38374: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.231.78.77
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=568838 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-02 10:46:56 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:33841: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:46:02 dovecot_login authenticator failed for H=(H15aBBKse) [165.154.254.163]:60197: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 10:46:49 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 10:47:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-02-02 10:47:25 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:55599: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:47:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53545: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.169.148.186
country_id: 2963597
domain: www.euratech.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home2/euratechcom/public_html/wp-admin||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 52.169.148.186
country_id: 2963597
domain: www.euratech.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/euratechcom/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:47:22 dovecot_login authenticator failed for H=(wnR2dkl) [158.94.208.175]:57020: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2026-02-02 10:47:35 dovecot_login authenticator failed for H=(173-25-186-130.client.mchsi.com) [173.25.186.130]:59495: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.194
country_id: 1269750
description:
2026-02-02 10:47:49 dovecot_login authenticator failed for H=(nsg-corporate-194.230.187.122.airtel.in) [122.187.230.194]:39250: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-02-02 10:47:19 dovecot_login authenticator failed for H=([85.19.195.12]) [85.19.195.12]:35194: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.194
country_id: 1269750
description:
2026-02-02 10:47:13 dovecot_login authenticator failed for H=(nsg-corporate-194.229.187.122.airtel.in) [122.187.229.194]:32978: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:47:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2026-02-02 10:47:31 dovecot_login authenticator failed for H=([220.93.167.144]) [220.93.167.144]:52534: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
country_id: 2017370
description:
2026-02-02 10:47:51 dovecot_login authenticator failed for H=([95.79.108.51]) [95.79.108.51]:50355: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-02 10:47:36 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:39764: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:47:20 dovecot_login authenticator failed for H=(4YAqC1JF) [165.154.254.163]:58623: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:48:38 dovecot_login authenticator failed for H=(VmHrK8Tg) [165.154.254.163]:56839: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2026-02-02 10:48:52 dovecot_login authenticator failed for H=([218.149.235.152]) [218.149.235.152]:52238: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:48:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:48:18 dovecot_login authenticator failed for H=(6phN9yn) [165.154.254.163]:53261: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-02 10:48:28 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:42640: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2026-02-02 10:48:15 dovecot_login authenticator failed for H=([91.73.195.150]) [91.73.195.150]:60933: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-02-02 10:48:26 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:49750: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:48:32 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58808: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 10:48:07 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59762: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 10:49:26 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.242
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/etc.clientlibs/digx/experience/clientlibs/element-clientlibs/menu.ACSHASHfdc49bee9ca12f400c3fb3e04ca22115.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:49:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52353: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.234
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/etc.clientlibs/digx/experience/clientlibs/clientlib-elements/disclosure-menu.ACSHASH308070785752f3e321a66800a89c0a0c.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.204
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/etc.clientlibs/digx/broadband-upper-funnel/components/content/universalEligibilityChecker/v1/universalEligibilityChecker/clientlib.ACSHASH4e01a8a0648eaf43f8472fbba56563af.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 172.59.186.245
country_id: 6252001
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/product-sub.php?id=24&sub=26 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.208
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/etc.clientlibs/digx/upper-funnel/clientlibs/clientlib-upper-funnel-main.ACSHASHd41d8cd98f00b204e9800998ecf8427e.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.159
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/etc.clientlibs/digx/experience/clientlibs/clientlib-elements/menu.ACSHASH582ece88a41377cf8cc7c735d324d041.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:49:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.251
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/etc.clientlibs/digx/unav/components/content/footer/v1/footer/clientlib.ACSHASH828e91f34bc5ef1c268eee53bbc194ec.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.225
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/etc.clientlibs/digx/experience/clientlibs/clientlib-grid.ACSHASHdafd48df1995790fcf0b5a3831d4812d.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.250
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/etc.clientlibs/digx/unav/clientlibs/clientlib-unav-main.ACSHASH6fedfd8202d7bd2289473496983e4045.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2026-02-02 10:49:12 dovecot_login authenticator failed for H=([218.149.235.152]) [218.149.235.152]:51666: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 10:49:32 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (nolon) [87.103.126.54]:32061: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.209
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/etc.clientlibs/digx/experience/clientlibs/clientlib-experience-components.ACSHASH4e2cc35d1be7e2eae98815b3eabef0f3.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.165
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/etc.clientlibs/digx/experience/components/content/snackbar/v1/snackbar/clientlib.ACSHASH916636e711e17bea17967038a8926849.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.196
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/etc.clientlibs/digx/experience/clientlibs/clientlib-tmobile.ACSHASHc756cca6cb190667a68257b925c29560.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.210
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/etc.clientlibs/digx/experience/clientlibs/clientlib-experience-main.ACSHASH5ed1ffa0d0602af69f045c10427014ab.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.219
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/etc.clientlibs/digx/experience/components/content/webScreenShare/v1/webScreenShare/clientlib.ACSHASH4a7d9549c0e695aacc6f49a87752d01f.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:49:17 dovecot_login authenticator failed for H=(K0tIuAvm) [165.154.254.163]:64184: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:49:28 dovecot_login authenticator failed for H=(3RtYmIWh9) [158.94.208.175]:49740: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.252
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/etc.clientlibs/digx/unav/components/content/utility-search/v1/utility-search/clientlib.ACSHASH614796a6c157ca8d2afdaadc8db8d822.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.197
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/etc.clientlibs/digx/unav/components/content/header/v1/header/clientlib.ACSHASH7e5638fd90cc7a1d9f5b763200ebcce7.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.189
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/etc.clientlibs/digx/experience/components/content/aiChat/v1/aiChat/clientlib.ACSHASH45a4cea81f4f00e36e3a179d596e906d.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-02 10:49:22 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:57728: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.222
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/etc.clientlibs/digx/experience/clientlibs/clientlib-experience-forms.ACSHASH29887980b5aeb2d82b712adc624b9f98.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.200
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/etc.clientlibs/digx/experience/clientlibs/clientlib-tmobile/resources/tdds/fonts/teleneo/web-v1.7/teleneoweb-extrabold.woff2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.188
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/etc.clientlibs/digx/experience/clientlibs/clientlib-experience-main/resources/sprite/icons.svg?v4.11 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:50:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.0.81.84
country_id: 1814991
description:
2026-02-02 10:50:31 dovecot_login authenticator failed for H=([111.0.81.84]) [111.0.81.84]:58368: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 10:50:30 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:50:32 dovecot_login authenticator failed for H=(lJLnPDm) [158.94.208.175]:56272: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2026-02-02 10:50:43 dovecot_login authenticator failed for H=nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:49707: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:50:15 dovecot_login authenticator failed for H=(sAd5A0) [165.154.254.163]:58094: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:50:22 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64930: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 10:50:32 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36104: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:51:03 dovecot_login authenticator failed for H=(RUK2RrWVj) [158.94.208.175]:58369: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.147.238
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/contact.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:51:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59366: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:51:13 dovecot_login authenticator failed for H=(VRP5Gbb) [165.154.254.163]:52566: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/login.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 10:52:43 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47184: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:52:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53691: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 212.30.36.99
country_id: 2921044
domain: www.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/adriv4.php||SC:/home2/fkrcom/public_html/assets||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 10:52:02 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:51424: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 167.94.146.56
country_id: 6252001
description:
2026-02-02 10:52:02 282473 [Warning] Aborted connection 282473 to db: 'unconnected' user: 'unauthenticated' host: '167.94.146.56' (This connection closed normally without authentication)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 191.8.7.253
country_id: 3469034
domain: imax.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:33817.imax.com.my||ServerName:imax.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:15735ba09a479e66fc42bfb84e978637de22919f||Title:0xf7c6b18e||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:52:49 dovecot_login authenticator failed for H=(qW1u8Lq) [165.154.254.163]:53459: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:52:06 dovecot_login authenticator failed for H=(hLQTwOwAwt) [158.94.208.175]:62679: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:52:11 dovecot_login authenticator failed for H=(W5Lk4yq4CL) [165.154.254.163]:62895: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:53:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65016: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:53:11 dovecot_login authenticator failed for H=(MWJRVA3E) [165.154.254.163]:56950: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-02-02 10:53:51 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:52443: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 10:54:57 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:48356: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:54:10 dovecot_login authenticator failed for H=(pebbkWA) [165.154.254.163]:51710: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/languages/images/sliders/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.91.153.26
country_id: 3077311
description:
2026-02-02 10:54:06 dovecot_login authenticator failed for H=u153-26.static.grape.cz [93.91.153.26]:49705: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:54:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59758: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:54:15 dovecot_login authenticator failed for H=(Y0lFlY) [158.94.208.175]:58127: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:54:27 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.152.61
country_id: 6252001
description:
2026-02-02 10:55:57 dovecot_plain authenticator failed for H=(atedgium) [50.187.152.61]:51726: 535 Incorrect authentication data (set_id=sylviagooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.115.144.103
country_id: 3469034
description:
2026-02-02 10:55:40 dovecot_login authenticator failed for H=(191.34.253.17.dynamic.adsl.gvt.net.br) [187.115.144.103]:35649: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:55:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65017: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.69.100.20
country_id: 2017370
description:
2026-02-02 10:55:43 dovecot_login authenticator failed for H=([127.0.0.1]) [178.69.100.20]:56341: 535 Incorrect authentication data (set_id=jessieteoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:55:45 dovecot_login authenticator failed for H=(JkQv5dU) [158.94.208.175]:51766: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.36
country_id: 2245662
description:
2026-02-02 10:55:54 dovecot_login authenticator failed for H=([213.154.80.21]) [213.154.80.36]:47776: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:55:07 dovecot_login authenticator failed for H=(vT2Qkl) [165.154.254.163]:62011: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:55:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.16.173.84
country_id: 2017370
description:
2026-02-02 10:55:37 dovecot_login authenticator failed for H=([127.0.0.1]) [5.16.173.84]:16180: 535 Incorrect authentication data (set_id=jessieteoh@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:56:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:56:04 dovecot_login authenticator failed for H=(GvXQicmp) [165.154.254.163]:55649: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-02-02 10:56:05 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:50628: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:56:24 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59483: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:56:18 dovecot_login authenticator failed for H=(gG1udH) [158.94.208.175]:54803: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-02-02 10:56:45 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:37240: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:57:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53886: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:57:39 dovecot_login authenticator failed for H=(QtFpVD) [165.154.254.163]:55603: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 10:57:08 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:60840: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:57:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:57:20 dovecot_login authenticator failed for H=(TSfzNE3q) [165.154.254.163]:52398: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 10:58:01 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57984: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.90.41.136
country_id: 1522867
description:
2026-02-02 10:59:00 dovecot_login authenticator failed for H=178.90.41.136.dynamic.telecom.kz [178.90.41.136]:56899: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.246.106
country_id: 1269750
description:
2026-02-02 10:58:51 dovecot_login authenticator failed for H=([125.19.172.119]) [125.20.246.106]:39672: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 10:58:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:58:17 dovecot_login authenticator failed for H=(nCYW5z92) [165.154.254.163]:62197: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:58:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57042: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-02 10:58:25 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:41620: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 10:58:07 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57984: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.126.53.11
country_id: 1835841
description:
2026-02-02 10:58:08 dovecot_login authenticator failed for H=([168.126.53.11]) [168.126.53.11]:58608: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 148.72.155.149
country_id: 6252001
description:
[2026-02-02 10:58:20 +0800] info [cpaneld] 148.72.155.149 - nexuscol "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nexuscol (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:58:22 dovecot_login authenticator failed for H=(tAiNTxk) [158.94.208.175]:53671: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 10:59:14 dovecot_login authenticator failed for H=(R5MJpSG5i) [165.154.254.163]:55477: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 10:59:17 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50652: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.36.176
country_id: 1819730
description:
2026-02-02 10:59:38 dovecot_login authenticator failed for H=176.36.103.218.static.netvigator.com ([127.0.0.1]) [218.103.36.176]:56766: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 10:59:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53138: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.156.51.21
country_id: 6252001
description:
2026-02-02 10:59:55 dovecot_login authenticator failed for H=47-156-51-21.fdr01.snjc.ca.ip.frontiernet.net ([127.0.0.1]) [47.156.51.21]:56408: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 10:59:23 dovecot_login authenticator failed for H=(7mrEsF) [158.94.208.175]:54825: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:00:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63110: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:00:11 dovecot_login authenticator failed for H=(MKmpaCpYQ) [165.154.254.163]:64789: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:00:27 dovecot_login authenticator failed for H=(5CSI02LJxh) [158.94.208.175]:64102: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.142.136
country_id: 1733045
description:
2026-02-02 11:00:47 dovecot_login authenticator failed for H=([127.0.0.1]) [49.124.142.136]:55670: 535 Incorrect authentication data (set_id=tigerchong@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.155.113
country_id: 1814991
description:
2026-02-02 11:00:55 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.155.113]:50175: 535 Incorrect authentication data (set_id=tigerchong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:01:50 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53804: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.68.181.139
country_id: 1814991
description:
2026-02-02 11:01:22 dovecot_login authenticator failed for H=([39.68.181.139]) [39.68.181.139]:16862: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 11:01:25 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47396: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:01:47 dovecot_login authenticator failed for H=(sySLEgsc5) [165.154.254.163]:64096: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:01:05 dovecot_login authenticator failed for H=(2AWg27) [158.94.208.175]:54768: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.2
country_id: 1269750
description:
2026-02-02 11:01:04 dovecot_login authenticator failed for H=([128.185.217.149]) [125.19.156.2]:44782: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:01:08 dovecot_login authenticator failed for H=(MX411iUH) [165.154.254.163]:57723: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:02:06 dovecot_login authenticator failed for H=(3LQA73LFD) [158.94.208.175]:60331: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 68.83.150.53
country_id: 6252001
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.krisfood.com/css/owl.carousel.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 24.238.33.79
country_id: 6252001
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.krisfood.com/css/font-awesome.min.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 69.250.228.111
country_id: 6252001
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.krisfood.com/js/theme_script.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.97.199.55
country_id: 6252001
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.krisfood.com/images/cocoa.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.246.173.56
country_id: 6252001
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.krisfood.com/images/logo1.gif HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 132.255.157.35
country_id: 3469034
domain: indfinitydesign.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:78209.indfinitydesign.com||ServerName:indfinitydesign.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ad146b777b74e74fe506ea4d057398dd518d25d5||Title:0x23125f4a||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 24.113.138.136
country_id: 6252001
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.krisfood.com/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 35.147.61.131
country_id: 6252001
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.krisfood.com/css/bootstrap.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 24.45.62.113
country_id: 6252001
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.krisfood.com/css/color.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:02:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53804: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.97.199.72
country_id: 6252001
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.krisfood.com/images/main_icon2.png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.97.199.193
country_id: 6252001
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.krisfood.com/images/footer-bg.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 66.177.188.243
country_id: 6252001
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.krisfood.com/css/responsive.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 173.59.6.116
country_id: 6252001
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.krisfood.com/css/style.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 9.138.37.75
country_id: 6252001
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.krisfood.com/js/bootstrap.min.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.233
country_id: 2750405
description:
2026-02-02 11:02:13 dovecot_login authenticator failed for H=(Copy-of-VM-2022) [2.58.56.233]:27993: 535 Incorrect authentication data (set_id=general@kimmark.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.31.69.179
country_id: 6252001
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.krisfood.com/js/jquery-1.11.3.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.97.199.76
country_id: 6252001
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.krisfood.com/images/cocoa-butter2.png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:02:06 dovecot_login authenticator failed for H=(HlH73bnR) [165.154.254.163]:50745: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.97.199.176
country_id: 6252001
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.krisfood.com/images/logo-klfood.png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.97.199.36
country_id: 6252001
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.krisfood.com/images/banner-img-3.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 35.149.143.19
country_id: 6252001
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.krisfood.com/js/owl.carousel.min.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 11:02:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.97.199.206
country_id: 6252001
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.krisfood.com/images/Cocoa-Raw-Beans-Chocolate.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 24.2.34.68
country_id: 6252001
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.krisfood.com/css/animate.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.97.199.71
country_id: 6252001
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.krisfood.com/images/banner-icon.png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:03:03 dovecot_login authenticator failed for H=(10WcsSEU4c) [165.154.254.163]:59730: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 11:03:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:03:08 dovecot_login authenticator failed for H=(NZyQJE) [158.94.208.175]:65100: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:03:16 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57182: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 11:03:33 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54892: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:04:12 dovecot_login authenticator failed for H=(hafZOySpB) [158.94.208.175]:60761: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.51.109
country_id: 1269750
description:
2026-02-02 11:04:35 dovecot_login authenticator failed for H=(abts-north-static-109.51.160.122.airtelbroadband.in) [122.160.51.109]:44236: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.33
country_id: 1733045
description:
2026-02-02 11:04:07 dovecot_login authenticator failed for H=([49.124.153.33]) [49.124.153.33]:38784: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:04:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64681: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 11:04:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:04:19 dovecot_login authenticator failed for H=(2ToGw1aO) [165.154.254.163]:55361: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 11:04:34 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:63984: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:05:12 dovecot_login authenticator failed for H=(5J8k5ON) [158.94.208.175]:51994: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:05:16 dovecot_login authenticator failed for H=(KTMDFVNhW) [165.154.254.163]:64344: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.21
country_id: 2750405
description:
Feb  2 11:05:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account inquiries@ktlog.com.my has been temporarily locked by Imunify PAM(46.151.182.21)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.20
country_id: 2750405
description:
Feb  2 11:05:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account inquiries@ktlog.com.my has been temporarily locked by Imunify PAM(46.151.182.20)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/photos/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 11:05:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 11:05:42 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38930: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:05:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62127: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.12
country_id: 2750405
description:
Feb  2 11:05:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account inquiries@ktlog.com.my has been temporarily locked by Imunify PAM(46.151.182.12)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.107.1
country_id: 1269750
description:
2026-02-02 11:05:49 dovecot_login authenticator failed for H=([144.24.107.1]) [144.24.107.1]:34408: 535 Incorrect authentication data (set_id=office@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.204
country_id: 1733045
description:
2026-02-02 11:06:04 dovecot_login authenticator failed for H=([49.124.149.204]) [49.124.149.204]:45086: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 11:06:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:06:32 dovecot_login authenticator failed for H=(oriWAkDV) [165.154.254.163]:59824: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 185.93.89.64
country_id: 130758
description:
Feb  2 11:07:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account inquiries@ktlog.com.my has been temporarily locked by Imunify PAM(185.93.89.64)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:06:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58452: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-02 11:06:30 283263 [Warning] Aborted connection 283263 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:06:32 dovecot_login authenticator failed for H=(ImcHVEb0) [158.94.208.175]:55882: 535 Incorrect authentication data (set_id=wilson)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/home/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:06:13 dovecot_login authenticator failed for H=(nXYJ7xqCc) [165.154.254.163]:56938: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:07:20 dovecot_login authenticator failed for H=(26Bgim) [158.94.208.175]:60059: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:07:10 dovecot_login authenticator failed for H=(VEpdgt0tm) [165.154.254.163]:49274: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.7.160
country_id: 1733045
description:
2026-02-02 11:07:48 dovecot_login authenticator failed for H=([183.171.7.160]) [183.171.7.160]:45610: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 11:07:51 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49554: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:07:18 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53890: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-02-02 11:07:27 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:53916: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/img/demos/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:08:07 dovecot_login authenticator failed for H=(0zURYS) [165.154.254.163]:58100: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.10.10.83
country_id: 3469034
description:
2026-02-02 11:08:58 dovecot_plain authenticator failed for H=(5D07V5) [177.10.10.83]:9319: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:08:16 dovecot_login authenticator failed for H=(YebYRi) [158.94.208.175]:49880: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:08:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49163: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.25
country_id: 2750405
description:
Feb  2 11:08:35 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account inquiries@ktlog.com.my has been temporarily locked by Imunify PAM(46.151.182.25)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.10.10.83
country_id: 3469034
description:
2026-02-02 11:09:05 dovecot_login authenticator failed for H=(U289EEWT) [177.10.10.83]:9700: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:09:23 dovecot_login authenticator failed for H=(AzDJLxf3r5) [158.94.208.175]:55097: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:09:38 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54118: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:09:05 dovecot_login authenticator failed for H=(g3yRCg) [165.154.254.163]:51214: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:10:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64819: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:10:02 dovecot_login authenticator failed for H=(btvoB00) [165.154.254.163]:60745: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:10:06 dovecot_login authenticator failed for H=(uPlw4JNmBf) [158.94.208.175]:61090: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 11:10:02 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39770: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.44.116.18
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/33chartcreate-multiple-charts.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.206.125.142
country_id: 1269750
description:
2026-02-02 11:10:57 dovecot_login authenticator failed for H=([117.206.125.142]) [117.206.125.142]:44606: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:10:40 dovecot_login authenticator failed for H=(ODwoxlHm) [165.154.254.163]:51157: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2026-02-02 11:10:47 dovecot_login authenticator failed for H=([83.239.84.130]) [83.239.84.130]:35425: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 11:10:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-02 11:10:29 283435 [Warning] Aborted connection 283435 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:11:03 dovecot_login authenticator failed for H=(YCp50yo) [158.94.208.175]:51294: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 11:11:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:11:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58120: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.14.24.50
country_id: 2658434
description:
2026-02-02 11:11:39 dovecot_login authenticator failed for H=50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:62495: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.108
country_id: 1814991
description:
2026-02-02 11:11:11 dovecot_login authenticator failed for H=([111.61.97.108]) [111.61.97.108]:18454: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:11:18 dovecot_login authenticator failed for H=(Mjt0cFRsud) [165.154.254.163]:58055: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-02-02 11:11:22 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:34628: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.101.241.44
country_id: 1835841
description:
2026-02-02 11:11:27 dovecot_login authenticator failed for H=([222.101.241.44]) [222.101.241.44]:34911: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
country_id: 1835841
description:
2026-02-02 11:11:34 dovecot_login authenticator failed for H=([211.223.41.90]) [211.223.41.90]:49534: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.118
country_id: 1269750
description:
2026-02-02 11:12:15 dovecot_login authenticator failed for H=([182.95.119.118]) [182.95.119.118]:44842: 535 Incorrect authentication data (set_id=postmaster@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 11:12:11 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57038: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 11:12:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.60.211.114
country_id: 6252001
description:
2026-02-02 11:12:32 dovecot_login authenticator failed for H=67-60-211-114.cpe.sparklight.net [67.60.211.114]:52335: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.245.142.83
country_id: 1835841
description:
2026-02-02 11:12:08 dovecot_login authenticator failed for H=([106.245.142.83]) [106.245.142.83]:52197: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:12:05 dovecot_login authenticator failed for H=(EltgvYrq) [158.94.208.175]:51690: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:12:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52444: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:12:15 dovecot_login authenticator failed for H=(FMiDmC) [165.154.254.163]:52133: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2026-02-02 11:12:04 dovecot_login authenticator failed for H=([27.123.119.235]) [122.185.176.126]:45936: 535 Incorrect authentication data (set_id=postmaster@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.22.245.18
country_id: 3469034
description:
2026-02-02 11:12:04 dovecot_login authenticator failed for H=([189.22.245.18]) [189.22.245.18]:61863: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:13:12 dovecot_login authenticator failed for H=(5332lo) [165.154.254.163]:52763: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:13:15 dovecot_login authenticator failed for H=(sDFAwJdjT) [158.94.208.175]:59013: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:13:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61516: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 11:13:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 11:14:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:14:09 dovecot_login authenticator failed for H=(LFhw102z) [165.154.254.163]:61851: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.22.245.18
country_id: 3469034
description:
2026-02-02 11:14:25 dovecot_login authenticator failed for H=([189.22.245.18]) [189.22.245.18]:62729: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-02-02 11:14:31 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:38100: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.206.14
country_id: 1269750
description:
2026-02-02 11:14:47 dovecot_login authenticator failed for H=([203.129.206.14]) [203.129.206.14]:35144: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:14:32 dovecot_login authenticator failed for H=(P3CjfbK2PV) [158.94.208.175]:55469: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:14:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55312: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 11:14:20 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50248: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 139.162.70.53
country_id: 1861060
description:
2026-02-02 11:14:27 283584 [Warning] Aborted connection 283584 to db: 'unconnected' user: 'unauthenticated' host: '139.162.70.53' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.114.111
country_id: 1880251
description:
2026-02-02 11:15:35 dovecot_login authenticator failed for H=([124.246.114.111]) [124.246.114.111]:33326: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2026-02-02 11:15:12 dovecot_login authenticator failed for H=([218.149.235.152]) [218.149.235.152]:49366: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 63.135.161.148
country_id: 6252001
description:
[2026-02-02 11:15:53 +0800] info [webmaild] 63.135.161.148 - fasya@pftfood.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:15:05 dovecot_login authenticator failed for H=(3ajj0j) [158.94.208.175]:56720: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
country_id: 1835841
description:
2026-02-02 11:15:24 dovecot_login authenticator failed for H=([175.206.113.91]) [175.206.113.91]:50652: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:15:26 dovecot_login authenticator failed for H=(HyrYg2pl3) [165.154.254.163]:57009: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.72
country_id: 1814991
description:
2026-02-02 11:15:12 dovecot_login authenticator failed for H=(72.20.167.124.adsl-pool.sx.cn) [124.167.20.72]:49675: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.105.71.106
country_id: 1814991
description:
2026-02-02 11:15:24 dovecot_login authenticator failed for H=([223.105.71.106]) [223.105.71.106]:56481: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.219.216.146
country_id: 357994
description:
2026-02-02 11:15:26 dovecot_plain authenticator failed for H=(lisischne) [196.219.216.146]:49752: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.27.42.6
country_id: 6252001
description:
[2026-02-02 11:15:31 +0800] info [cpaneld] 34.27.42.6 - nexuscol "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nexuscol (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:15:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61479: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:15:06 dovecot_login authenticator failed for H=(d0HgHzk) [165.154.254.163]:53479: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:16:08 dovecot_login authenticator failed for H=(ykLf6lh) [158.94.208.175]:49459: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2026-02-02 11:16:28 dovecot_login authenticator failed for H=(46.30.161.197.access.ipnet.ua) [46.30.161.197]:46702: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 103.157.49.19
country_id: 1643084
domain: kimmark.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:'-var_dump(md5(306228888))-'||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 103.157.49.19
country_id: 1643084
domain: kimmark.com
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:7.71||T:APACHE||SC:/home2/kimmark/public_html/product-sub.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:16:04 dovecot_login authenticator failed for H=(7733cufaS) [165.154.254.163]:49315: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:16:22 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54992: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 11:16:29 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:60470: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.41.104.55
country_id: 1327865
description:
2026-02-02 11:16:54 dovecot_plain authenticator failed for H=(8N8LN255TCKTWN) [45.41.104.55]:21602: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 103.157.49.19
country_id: 1643084
domain: kimmark.com
description:
IM360 WAF: Special shell symbol in request||MV:@var_dump(md5(614093402)||MVN:ARGS:id||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.166
country_id: 1269750
description:
2026-02-02 11:16:17 dovecot_login authenticator failed for H=([182.95.185.166]) [182.95.185.166]:54994: 535 Incorrect authentication data (set_id=sales@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.89.155.11
country_id: 2542007
description:
2026-02-02 11:17:32 dovecot_login authenticator failed for H=(3cYEsZ) [196.89.155.11]:29733: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/services/images/sliders/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:17:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49325: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:17:15 dovecot_login authenticator failed for H=(na3tSCKb0l) [158.94.208.175]:51643: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:17:20 dovecot_login authenticator failed for H=(57ZXbtuVFW) [165.154.254.163]:63672: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-02-02 11:18:32 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:54050: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:18:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57867: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-02-02 11:18:20 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:43026: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 11:18:10 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:52415: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 11:18:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:18:17 dovecot_login authenticator failed for H=(FZSz0mB4Wi) [165.154.254.163]:57721: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-02-02 11:18:18 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:39222: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 11:18:46 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49474: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:18:02 dovecot_login authenticator failed for H=(Rm66tgK) [158.94.208.175]:57636: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2026-02-02 11:18:06 dovecot_login authenticator failed for H=([218.149.235.152]) [218.149.235.152]:48064: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:18:57 dovecot_login authenticator failed for H=(ClBF0r) [158.94.208.175]:63603: 535 Incorrect authentication data (set_id=wilson)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.163.98.66
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/training-details.php?id=633975 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 11:19:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:19:15 dovecot_login authenticator failed for H=(VyIUIuQ) [165.154.254.163]:52978: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
country_id: 1269750
description:
2026-02-02 11:19:49 dovecot_login authenticator failed for H=([103.55.89.5]) [116.75.218.103]:45032: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:19:11 dovecot_login authenticator failed for H=(n8i6gTj9y) [158.94.208.175]:49899: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:19:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52206: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2026-02-02 11:19:59 dovecot_login authenticator failed for H=([70.120.1.74]) [70.120.1.74]:61877: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
country_id: 2017370
description:
2026-02-02 11:20:17 dovecot_login authenticator failed for H=([95.79.108.51]) [95.79.108.51]:43138: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 11:20:59 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46074: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-02-02 11:20:02 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:32814: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 11:20:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:20:12 dovecot_login authenticator failed for H=(vUk0aACK) [165.154.254.163]:63913: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 11:20:29 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account wilson has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:20:04 dovecot_login authenticator failed for H=(AQ1Pp05GM) [158.94.208.175]:52196: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.21
country_id: 2750405
description:
Feb  2 11:20:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account jb-sales@mckd.com.my has been temporarily locked by Imunify PAM(46.151.182.21)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.12
country_id: 2750405
description:
Feb  2 11:20:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account jb-sales@mckd.com.my has been temporarily locked by Imunify PAM(46.151.182.12)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:20:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56511: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.20
country_id: 2750405
description:
Feb  2 11:20:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account jb-sales@mckd.com.my has been temporarily locked by Imunify PAM(46.151.182.20)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:21:10 dovecot_login authenticator failed for H=(r4nfv2sNl) [165.154.254.163]:58326: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 11:21:31 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account wilson has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:21:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62819: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 11:21:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.42
country_id: 1149361
description:
2026-02-02 11:21:47 dovecot_login authenticator failed for H=([180.94.75.42]) [180.94.75.42]:37049: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.245
country_id: 1814991
description:
2026-02-02 11:21:56 dovecot_login authenticator failed for H=([111.61.176.245]) [111.61.176.245]:29670: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:21:10 dovecot_login authenticator failed for H=(PCotX1j) [158.94.208.175]:62471: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
country_id: 1269750
description:
2026-02-02 11:21:40 dovecot_login authenticator failed for H=([103.55.89.5]) [116.75.218.103]:35100: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 11:22:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:22:34 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54483: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.242.147
country_id: 1733045
description:
[2026-02-02 11:22:41 +0800] info [webmaild] 27.125.242.147 - kwangpeng@ktlog.com.my "POST /cpsess5343171980/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.241.176] != Current IP Address [27.125.242.147]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:22:07 dovecot_login authenticator failed for H=(ArIXZ68Nw) [165.154.254.163]:53118: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:22:14 dovecot_login authenticator failed for H=(y1oaqW92n) [158.94.208.175]:53183: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.35.18
country_id: 1814991
description:
2026-02-02 11:22:40 dovecot_login authenticator failed for H=([60.174.35.18]) [60.174.35.18]:36028: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
country_id: 1269750
description:
2026-02-02 11:22:07 dovecot_login authenticator failed for H=([103.68.52.210]) [103.68.52.210]:33088: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2026-02-02 11:22:09 dovecot_plain authenticator failed for H=c-73-208-81-125.hsd1.in.comcast.net (unacals) [73.208.81.125]:60638: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 11:22:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account wilson has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2026-02-02 11:22:20 dovecot_plain authenticator failed for H=c-73-213-237-28.hsd1.va.comcast.net (unrade) [73.213.237.28]:50962: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-02 11:22:39 284002 [Warning] Aborted connection 284002 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.242.219.164
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=2&sub=6 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 11:23:25 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account wilson has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:23:23 dovecot_login authenticator failed for H=(64v5iFltU) [165.154.254.163]:50986: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.25
country_id: 2750405
description:
Feb  2 11:23:32 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account jb-sales@mckd.com.my has been temporarily locked by Imunify PAM(46.151.182.25)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.134
country_id: 1149361
description:
2026-02-02 11:23:12 dovecot_login authenticator failed for H=([149.54.62.134]) [149.54.62.134]:40837: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:23:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49915: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:23:04 dovecot_login authenticator failed for H=(2aX4aH) [165.154.254.163]:63727: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:23:27 dovecot_login authenticator failed for H=(ZnLeEtHO8) [158.94.208.175]:65523: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2026-02-02 11:23:28 dovecot_login authenticator failed for H=(nsg-static-145.58.71.182.airtel.in) [27.123.102.50]:39572: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 11:23:11 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:34492: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-02-02 11:24:53 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:48294: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 11:25:02 dovecot_login authenticator failed for H=(4FDLzJKP) [69.5.189.21]:56168: 535 Incorrect authentication data (set_id=miner_sandy@imax.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:24:20 dovecot_login authenticator failed for H=(Go9f6p) [165.154.254.163]:61903: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:24:15 dovecot_login authenticator failed for H=(WnNaZlZW) [158.94.208.175]:62468: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.37.249.59
country_id: 357994
description:
2026-02-02 11:24:18 dovecot_plain authenticator failed for H=(CUF28CYXYG583UI9) [41.37.249.59]:4365: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
country_id: 1835841
description:
2026-02-02 11:24:36 dovecot_login authenticator failed for H=([121.128.76.109]) [61.72.59.106]:55671: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:24:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60377: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 11:24:33 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account wilson has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
country_id: 2017370
description:
2026-02-02 11:25:08 dovecot_login authenticator failed for H=([95.79.108.51]) [95.79.108.51]:50856: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 11:25:22 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53400: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:25:03 dovecot_login authenticator failed for H=(FZxvSW) [158.94.208.175]:60647: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:25:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54537: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:25:17 dovecot_login authenticator failed for H=(hjbzhoJ) [165.154.254.163]:56447: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 11:25:25 dovecot_login authenticator failed for H=(PxLN04) [69.5.189.21]:60138: 535 Incorrect authentication data (set_id=miner_sandy@imax.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 11:26:01 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58178: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.22.38.37
country_id: 3865483
description:
2026-02-02 11:26:46 dovecot_plain authenticator failed for H=(P756S1ACH72QLPV) [186.22.38.37]:56839: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 11:26:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 11:26:13 dovecot_login authenticator failed for H=(PwNHBDutnM) [69.5.189.21]:51780: 535 Incorrect authentication data (set_id=miner_sandy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:26:14 dovecot_login authenticator failed for H=(8aYMAumc) [165.154.254.163]:50997: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:26:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64764: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:26:04 dovecot_login authenticator failed for H=(YqrlCK) [158.94.208.175]:60332: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2026-02-02 11:26:05 dovecot_plain authenticator failed for H=c-73-13-220-220.hsd1.de.comcast.net (sothiness) [73.13.220.220]:60320: 535 Incorrect authentication data (set_id=jun@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-02-02 11:26:07 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58178: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 11:27:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:27:11 dovecot_login authenticator failed for H=(JwjyHIya) [165.154.254.163]:62542: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:27:29 dovecot_login authenticator failed for H=(ohhu8x) [158.94.208.175]:51067: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:27:33 dovecot_login authenticator failed for H=(lPDXQp5) [158.94.208.175]:55194: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:27:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59413: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 11:27:22 dovecot_login authenticator failed for H=(zZKmPSxe) [69.5.189.21]:63531: 535 Incorrect authentication data (set_id=miner_sandy@imax.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 11:27:31 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47310: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/demos/img/contact-us.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 11:28:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:28:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54687: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:28:08 dovecot_login authenticator failed for H=(5lJmSLO9I) [165.154.254.163]:57814: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 11:28:10 dovecot_login authenticator failed for H=(6vh21wDiy) [69.5.189.21]:54997: 535 Incorrect authentication data (set_id=miner_sandy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:28:11 dovecot_login authenticator failed for H=(89phus3v) [158.94.208.175]:58603: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:29:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53568: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 11:29:40 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35874: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:29:14 dovecot_login authenticator failed for H=(hLNjCjSX5h) [158.94.208.175]:57632: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 11:29:19 dovecot_login authenticator failed for H=(a9pAwd) [69.5.189.21]:50403: 535 Incorrect authentication data (set_id=miner_sandy@imax.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 11:29:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:29:05 dovecot_login authenticator failed for H=(4WuIwEe) [165.154.254.163]:53457: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-02-02 11:30:07 dovecot_login authenticator failed for H=(DFHpO4Ei) [69.5.189.21]:58401: 535 Incorrect authentication data (set_id=miner_sandy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:30:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64253: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 11:30:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:30:21 dovecot_login authenticator failed for H=(pEEqxM) [165.154.254.163]:55161: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:30:20 dovecot_login authenticator failed for H=(JPAoYfZP) [158.94.208.175]:58682: 535 Incorrect authentication data (set_id=wilson@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
country_id: 6252001
description:
2026-02-02 11:30:36 dovecot_plain authenticator failed for H=syn-050-074-136-134.biz.spectrum.com (semic) [50.74.136.134]:50234: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:31:51 dovecot_login authenticator failed for H=(156no5xi) [158.94.208.175]:54378: 535 Incorrect authentication data (set_id=wilson@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:31:18 dovecot_login authenticator failed for H=(lT4EjVU) [165.154.254.163]:52358: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:31:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58676: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.42.246.122
country_id: 6252001
description:
2026-02-02 11:31:46 dovecot_plain authenticator failed for H=syn-071-042-246-122.biz.spectrum.com (I7QG1XB55L1Y) [71.42.246.122]:53490: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:31:14 dovecot_login authenticator failed for H=(sOUJkkRoV) [158.94.208.175]:51448: 535 Incorrect authentication data (set_id=wilson@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 11:31:52 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55508: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:32:11 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52984: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:32:15 dovecot_login authenticator failed for H=(MfcoTUe7XK) [158.94.208.175]:55433: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:32:15 dovecot_login authenticator failed for H=(dew4HwNY) [165.154.254.163]:50041: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2026-02-02 11:32:44 dovecot_plain authenticator failed for H=c-68-82-141-145.hsd1.pa.comcast.net (inines) [68.82.141.145]:47980: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 11:34:01 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57970: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:33:12 dovecot_login authenticator failed for H=(W7qE9G) [165.154.254.163]:64474: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:33:19 dovecot_login authenticator failed for H=(zWIHZd9e) [158.94.208.175]:56588: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:33:04 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64101: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 11:33:18 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:51694: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 11:34:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:34:09 dovecot_login authenticator failed for H=(Xyb0AsK4K) [165.154.254.163]:61447: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 11:34:50 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account wilson@oxbold.com has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:34:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58933: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:34:17 dovecot_login authenticator failed for H=(9mSvyCH) [158.94.208.175]:64167: 535 Incorrect authentication data (set_id=wilson@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:35:56 dovecot_login authenticator failed for H=(AMsgyvb3E) [158.94.208.175]:60133: 535 Incorrect authentication data (set_id=wilson@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 11:35:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:35:08 dovecot_login authenticator failed for H=(7Uf9v3eXmX) [158.94.208.175]:56941: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 11:35:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account wilson@oxbold.com has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 11:35:51 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (turocal) [87.103.126.54]:48523: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:35:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52920: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:35:06 dovecot_login authenticator failed for H=(B8Wd1IJA) [165.154.254.163]:58783: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 11:36:08 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53034: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.118.138
country_id: 732800
description:
2026-02-02 11:36:23 dovecot_login authenticator failed for H=([62.182.118.138]) [62.182.118.138]:45690: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.108.88.121
country_id: 1814991
description:
2026-02-02 11:36:41 dovecot_login authenticator failed for H=([113.108.88.121]) [113.108.88.121]:41570: 535 Incorrect authentication data (set_id=info@wohcheong.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 11:36:26 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account wilson@oxbold.com has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.73.94
country_id: 1269750
description:
2026-02-02 11:36:53 dovecot_login authenticator failed for H=([125.19.196.193]) [182.78.73.94]:48728: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.177.131.33
country_id: 1861060
description:
2026-02-02 11:36:07 dovecot_plain authenticator failed for H=(vxp6vyc1hpqb4ojr0cjjudg1em01ztnv) [94.177.131.33]:39408: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.67.190.16
country_id: 1814991
description:
2026-02-02 11:36:34 dovecot_login authenticator failed for H=(16.190.67.125.broad.gz.sc.dynamic.163data.com.cn) [125.67.190.16]:43820: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:36:03 dovecot_login authenticator failed for H=(7g0JTo) [165.154.254.163]:55506: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 11:36:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:36:20 dovecot_login authenticator failed for H=(SkJda2) [158.94.208.175]:57487: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:36:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59035: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.166.111.221
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=52281516782974 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:37:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59035: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 11:37:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account wilson@oxbold.com has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 11:37:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:37:19 dovecot_login authenticator failed for H=(wvqV12h6) [165.154.254.163]:55938: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:37:19 dovecot_login authenticator failed for H=(gKfjU8iPQ) [158.94.208.175]:53095: 535 Incorrect authentication data (set_id=wilson@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:38:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64391: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 11:38:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:38:16 dovecot_login authenticator failed for H=(pmfrVr4vAW) [165.154.254.163]:52106: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:38:15 dovecot_login authenticator failed for H=(4F9t2r) [158.94.208.175]:52181: 535 Incorrect authentication data (set_id=wilson@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 11:38:20 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57448: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-02-02 11:38:43 dovecot_plain authenticator failed for H=(asenet) [12.150.243.22]:44944: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
country_id: 290557
description:
2026-02-02 11:38:01 dovecot_plain authenticator failed for H=(slentine) [5.32.61.6]:42723: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  2 11:38:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account wilson@oxbold.com has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:39:19 dovecot_login authenticator failed for H=(9XpG2Q) [158.94.208.175]:50046: 535 Incorrect authentication data (set_id=wilson@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:39:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58912: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.20.187.198
country_id: 1605651
description:
2026-02-02 11:39:35 dovecot_plain authenticator failed for H=(PMAJ2FF461FCD) [1.20.187.198]:65362: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:39:13 dovecot_login authenticator failed for H=(nJLcTSQ3) [165.154.254.163]:65003: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.219.167.24
country_id: 3865483
description:
2026-02-02 11:39:18 dovecot_plain authenticator failed for H=(V4836VC8A) [201.219.167.24]:51845: 535 Incorrect authentication data (set_id=payment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:40:18 dovecot_login authenticator failed for H=(Uh6J3mJC) [158.94.208.175]:56750: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 11:40:29 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56126: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:40:29 dovecot_login authenticator failed for H=(TYvxRDCZnn) [165.154.254.163]:64670: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.175.223.141
country_id: 1643084
description:
2026-02-02 11:40:35 dovecot_plain authenticator failed for H=(5HJ30XO6291) [103.175.223.141]:51407: 535 Incorrect authentication data (set_id=rnd@plomalite.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:40:10 dovecot_login authenticator failed for H=(UZDf80uRj) [165.154.254.163]:60776: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:40:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52636: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:41:05 dovecot_login authenticator failed for H=(30S4Atc) [158.94.208.175]:51704: 535 Incorrect authentication data (set_id=wilson@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:41:07 dovecot_login authenticator failed for H=(PU0bqT) [165.154.254.163]:55923: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:41:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63280: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:42:05 dovecot_login authenticator failed for H=(WgCneEg) [158.94.208.175]:56698: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:42:04 dovecot_login authenticator failed for H=(JhNtb0) [165.154.254.163]:51874: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 11:42:38 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:45022: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 11:42:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:42:04 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55274: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.242.1.206
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=3&page_id=1&sub=41 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:43:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55822: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.254.163
country_id: 6252001
description:
Feb  2 11:43:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 165.154.254.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.163
country_id: 6252001
description:
2026-02-02 11:43:20 dovecot_login authenticator failed for H=(Rvlt8b5JK) [165.154.254.163]:51359: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-02 11:43:05 dovecot_login authenticator failed for H=(9aarFQ2f24) [158.94.208.175]:56968: 535 Incorrect authentication data (set_id=wilson@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 11:44:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50396: 535 Incorrect authentication data (set_id=admin@oxbold.com)


