# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:18:16 dovecot_login authenticator failed for H=(sZb0OSFup) [178.16.54.138]:51691: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.172.106.105
country_id: 1814991
description:
2026-01-31 10:18:38 dovecot_login authenticator failed for H=([112.45.66.28]) [117.172.106.105]:39618: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:18:41 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:18:01 dovecot_login authenticator failed for H=(XnkHbCvg) [158.94.209.22]:58435: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:18:15 dovecot_login authenticator failed for H=(h1RQ9tZs7G) [77.83.39.64]:51071: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 10:18:40 dovecot_login authenticator failed for H=(PRyuKh0e) [158.94.208.110]:59569: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:aa59ef1a86535237d8f4d24d7221dbe08e4a50d8||Title:0xd3cb15d0||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:19:05 dovecot_login authenticator failed for H=(pWTTHWnU) [77.83.39.64]:57767: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:19:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
country_id: 1835841
description:
2026-01-31 10:19:27 dovecot_login authenticator failed for H=([175.206.113.91]) [175.206.113.91]:41744: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:19:09 dovecot_login authenticator failed for H=(mpUFejIBjw) [178.16.54.138]:57717: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 10:19:04 dovecot_login authenticator failed for H=(b5BQBLv) [158.94.208.110]:63420: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:19:13 dovecot_login authenticator failed for H=(ParHsCTa) [158.94.209.22]:55620: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
country_id: 1835841
description:
2026-01-31 10:19:41 dovecot_login authenticator failed for H=([118.36.234.156]) [118.36.234.156]:40338: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:236928ff767fb1ea0f6badfcf16856a3cc5e9873||Title:0x2caa5729||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 10:20:38 dovecot_login authenticator failed for H=(JV6udcgMS) [158.94.208.110]:62154: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:20:07 dovecot_login authenticator failed for H=(vlxSrv) [178.16.54.138]:61646: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:20:15 dovecot_login authenticator failed for H=(fIB2VksW3) [77.83.39.64]:49205: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.47.180
country_id: 6252001
description:
[2026-01-31 10:20:09 +0800] info [webmaild] 104.207.47.180 - kitty.yap@manforce.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:20:10 dovecot_login authenticator failed for H=(mPcDD441A) [158.94.209.22]:51167: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:20:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:20:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:21:04 dovecot_login authenticator failed for H=(DJFcsVDou) [158.94.209.22]:54469: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.13
country_id: 1269750
description:
2026-01-31 10:21:06 dovecot_login authenticator failed for H=(nsg-corporate-13.230.187.122.airtel.in) [122.187.230.13]:44452: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:21:07 dovecot_login authenticator failed for H=(6jJkQiq) [77.83.39.64]:54566: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:21:22 dovecot_login authenticator failed for H=(cG8wuKay1H) [158.94.209.22]:64701: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 10:21:02 dovecot_login authenticator failed for H=(R5jLy5zeZR) [158.94.208.110]:49681: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:21:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 10:21:23 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:8387: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:21:02 dovecot_login authenticator failed for H=(o3Gkul) [178.16.54.138]:54484: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2fcb4f2d1be656cd1ad80787a4ed7e9c5289ce4e||Title:0x8412cf93||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:21:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:22:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:22:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:22:25 dovecot_login authenticator failed for H=(ICZHVOfAKN) [77.83.39.64]:55621: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 10:22:37 dovecot_login authenticator failed for H=(Xfnjki6JE) [158.94.208.110]:65444: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
country_id: 2623032
description:
2026-01-31 10:22:46 dovecot_login authenticator failed for H=(84-238-92-245.ptr.bnaa.dk) [84.238.92.245]:59156: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:22:16 dovecot_login authenticator failed for H=(1hq9fS) [158.94.209.22]:62211: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:22:17 dovecot_login authenticator failed for H=(cHoK34) [178.16.54.138]:54197: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.115.173.11
country_id: 1269750
description:
2026-01-31 10:22:22 dovecot_login authenticator failed for H=([45.115.173.11]) [45.115.173.11]:44106: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1f359547e7d8d4fc9f57aeffb177787c51686b58||Title:0xb28bd85b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:23:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.252.42.171
country_id: 1835841
description:
2026-01-31 10:23:47 dovecot_login authenticator failed for H=([211.252.42.171]) [211.252.42.171]:38518: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:23:15 dovecot_login authenticator failed for H=(0vjDrRc2) [77.83.39.64]:62455: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:23:10 dovecot_login authenticator failed for H=(w300vVx) [158.94.209.22]:56258: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:23:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:23:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 77.83.39.64


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.137.92
country_id: 1835841
domain: chs.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home2/chscommy/public_html/assets||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
country_id: 1835841
description:
2026-01-31 10:24:00 dovecot_login authenticator failed for H=([220.95.14.102]) [220.95.14.102]:55368: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 10:23:01 dovecot_login authenticator failed for H=(sU0XcMBzx) [158.94.208.110]:52965: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:75c8bc790a1640c75ea11a5b5b6605a95d47388b||Title:0x5a7f7750||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:23:12 dovecot_login authenticator failed for H=(snOxPGhji9) [178.16.54.138]:54561: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:24:04 dovecot_login authenticator failed for H=(TZsb2K) [158.94.209.22]:61978: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:24:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9edaab3197583e1e496854d6d77fd9827cdf36bf||Title:0x9db3b183||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:24:08 dovecot_login authenticator failed for H=(mWvr8Hvi) [178.16.54.138]:49388: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:24:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:24:07 dovecot_login authenticator failed for H=(m2XYBTP8) [77.83.39.64]:54293: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2026-01-31 10:25:38 dovecot_login authenticator failed for H=([152.52.244.46]) [152.52.244.46]:50062: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-01-31 10:25:48 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:40210: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-01-31 10:25:57 dovecot_login authenticator failed for H=([193.46.192.20]) [193.46.192.20]:51169: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:25:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:25:16 dovecot_login authenticator failed for H=(wT2m6K5o) [158.94.209.22]:56333: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.255.50
country_id: 1269750
description:
2026-01-31 10:25:51 dovecot_login authenticator failed for H=(nsg-corporate-50.255.186.122.airtel.in) [122.186.255.50]:51792: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0cd978017c402bb993d2310bcd01b07801eb398a||Title:0xd42ada7b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:25:24 dovecot_login authenticator failed for H=(qWTqtNpdMK) [77.83.39.64]:63346: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:25:27 dovecot_login authenticator failed for H=(60S3DlaX) [178.16.54.138]:59627: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:25:34 dovecot_login authenticator failed for H=(EIeviLL3XH) [158.94.209.22]:65410: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-01-31 10:25:36 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:43151: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.107.196.151
country_id: 2017370
description:
2026-01-31 10:25:41 dovecot_login authenticator failed for H=(ip-217.107.196.151.lipetsk.zelenaya.net) [217.107.196.151]:53778: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.71.84.38
country_id: 3469034
description:
2026-01-31 10:25:52 dovecot_login authenticator failed for H=([200.71.84.38]) [200.71.84.38]:34138: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.217.70.151
country_id: 1814991
description:
2026-01-31 10:25:27 dovecot_login authenticator failed for H=([171.217.70.151]) [171.217.70.151]:58604: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:26:18 dovecot_login authenticator failed for H=(ZO3I4tTMUQ) [178.16.54.138]:60063: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.19.197.207
country_id: 6252001
description:
2026-01-31 10:26:32 dovecot_plain authenticator failed for H=([10.18.18.187]) [37.19.197.207]:35002: 535 Incorrect authentication data (set_id=jessie@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:26:10 dovecot_login authenticator failed for H=(oXiv9rpB4) [158.94.209.22]:49639: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.200.240.65
country_id: 2017370
description:
2026-01-31 10:26:19 dovecot_plain authenticator failed for H=ismtj.co (tbteeylqvzopiztkfsanphc) [185.200.240.65]:46740: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:26:11 dovecot_login authenticator failed for H=(ZVTDDfm62) [77.83.39.64]:56399: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:26:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky@ahfengineering.com has been locked for the attacker IP 77.83.39.64


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6eab53b0e3205a8dd318375fe9e05d402ea39545||Title:0x180fc7c9||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.138.116.55
country_id: 2750405
description:
[2026-01-31 10:27:18 +0800] info [webmaild] 195.138.116.55 - prayerlink@agpc.org.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-31 10:27:52 dovecot_login authenticator failed for H=(www.safecleen.com) [58.49.113.138]:11981: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:27:23 dovecot_login authenticator failed for H=(m9YGeYDlwz) [77.83.39.64]:49573: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:27:04 dovecot_login authenticator failed for H=(XldEAXg) [158.94.209.22]:59303: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.241.119.219
country_id: 6252001
description:
2026-01-31 10:27:10 dovecot_plain authenticator failed for H=([10.30.18.58]) [151.241.119.219]:5798: 535 Incorrect authentication data (set_id=jessie@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.251.197.46
country_id: 1814991
description:
2026-01-31 10:27:41 dovecot_login authenticator failed for H=([101.251.197.46]) [101.251.197.46]:45108: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:27:57 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:27:16 dovecot_login authenticator failed for H=(qtmpXmo) [178.16.54.138]:60678: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ca844a301c7938808400563a02d09d4e663e3245||Title:0x749b2f72||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-01-31 10:28:04 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:45294: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:28:11 dovecot_login authenticator failed for H=(PMCrcZ) [77.83.39.64]:56200: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:29:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:28:08 dovecot_login authenticator failed for H=(WDIa6Liyn) [178.16.54.138]:54634: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:28:17 dovecot_login authenticator failed for H=(3uzrTf) [158.94.209.22]:55608: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:28:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 69.160.160.56
country_id: 6252001
domain: achieversvisionacademy.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/81.0.4044.92 Safari/537.36||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d50bd9623d6daabba86692dbbb8c5d5d4e9a4b6d||Title:0x92df3c4f||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:29:47 dovecot_login authenticator failed for H=(2KUeHMhh) [158.94.209.22]:53772: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:29:23 dovecot_login authenticator failed for H=(LWEyITLlZ) [77.83.39.64]:53747: 535 Incorrect authentication data (set_id=cky)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:093e2c8f306e44f2327b55fc2d6ceb5a2cb51dd4||Title:0x47061fd8||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:29:11 dovecot_login authenticator failed for H=(Ld2beyK) [158.94.209.22]:58359: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.145.151.168
country_id: 6252001
description:
2026-01-31 10:29:47 dovecot_login authenticator failed for H=47-145-151-168.fdr01.blpk.ca.ip.frontiernet.net [47.145.151.168]:45250: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/osl.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:29:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.154.34.130
country_id: 298795
description:
2026-01-31 10:29:33 dovecot_login authenticator failed for H=(server.keyubu.com) [94.154.34.130]:47044: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:29:28 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.50
country_id: 2017370
description:
2026-01-31 10:29:54 dovecot_login authenticator failed for H=([178.178.222.50]) [178.178.222.50]:46088: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.22.68.213
country_id: 1835841
description:
2026-01-31 10:29:58 dovecot_login authenticator failed for H=([59.22.68.213]) [59.22.68.213]:55200: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:29:03 dovecot_login authenticator failed for H=(6oDQkEg) [178.16.54.138]:61490: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:kcswebtechnologies.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:49510ff090c0e78d5c2afd90635a34425d11f5d6||Title:0x609ed800||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:30:12 dovecot_login authenticator failed for H=(wSKWPgp6M) [77.83.39.64]:59827: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.145.160.134
country_id: 1269750
description:
2026-01-31 10:30:27 dovecot_login authenticator failed for H=([125.62.129.188]) [59.145.160.134]:34780: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-01-31 10:30:59 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:54208: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:30:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:30:36 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.139.168.236
country_id: 2510769
description:
2026-01-31 10:30:02 dovecot_login authenticator failed for H=236.red-2-139-168.staticip.rima-tde.net [2.139.168.236]:34335: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:30:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.4
country_id: 1835841
description:
2026-01-31 10:30:05 dovecot_login authenticator failed for H=([203.252.10.4]) [203.252.10.4]:60352: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.7.171
country_id: 1733045
description:
2026-01-31 10:30:52 dovecot_login authenticator failed for H=([183.171.7.171]) [183.171.7.171]:37978: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:30:23 dovecot_login authenticator failed for H=(FcZ09ZFn9f) [178.16.54.138]:56245: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.59.242
country_id: 798544
description:
2026-01-31 10:30:50 dovecot_login authenticator failed for H=(ADMIN) [138.199.59.242]:4031: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:30:05 dovecot_login authenticator failed for H=(HpF6EH4) [158.94.209.22]:57870: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.84.54.74
country_id: 3996063
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.aoto.com.my/product.php?category=Primers Series&page=2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:31:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:31:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:31:16 dovecot_login authenticator failed for H=(LdgZM9YU) [178.16.54.138]:61960: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:31:17 dovecot_login authenticator failed for H=(KDzwOrD3R6) [158.94.209.22]:51428: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/about-us/images/sliders/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/about-us||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:kcswebtechnologies.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:799f1e76eac2061bc15f578164c7b6b46dc17585||Title:0x79e223ab||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 35.87.112.248
country_id: 6252001
domain: geminiflourmill.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/blog/mon/particulier/loginform3ad6.php||SC:/home2/cabecom/public_html/img/blog||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:31:26 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:31:03 dovecot_login authenticator failed for H=(9F2203) [77.83.39.64]:58575: 535 Incorrect authentication data (set_id=cky)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:kcswebtechnologies.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:79c8aa6f4d11dc2e429404aedf8d154fb80ac56a||Title:0xd75086ab||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:32:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 77.83.39.64


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 68.221.64.41
country_id: 2510769
domain: lvconsult.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/lvconsultcom/public_html/wp-includes/SimplePie/wp-login.php||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:32:11 dovecot_login authenticator failed for H=(E6FfgC0v) [158.94.209.22]:53415: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: u-net.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2024/index.php||SC:/home/unetcom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.130
country_id: 1269750
description:
2026-01-31 10:32:59 dovecot_login authenticator failed for H=([27.123.114.130]) [27.123.114.130]:46828: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:32:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:32:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:32:15 dovecot_login authenticator failed for H=(f5Bj78EV) [77.83.39.64]:64834: 535 Incorrect authentication data (set_id=cky)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 68.221.64.41
country_id: 2510769
domain: lvconsult.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/admin/upload/css.php||SC:/home/lvconsultcom/public_html/admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:32:11 dovecot_login authenticator failed for H=(nrsLtxPKH) [178.16.54.138]:54637: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.56.155.146
country_id: 1814991
description:
2026-01-31 10:32:37 dovecot_login authenticator failed for H=([58.56.155.146]) [58.56.155.146]:34122: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:kcswebtechnologies.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1695c8c018f1a881d70c5aa552ce4ede0aaa8fc9||Title:0x5fd46a62||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.25.236.147
country_id: 2017370
description:
2026-01-31 10:33:20 dovecot_login authenticator failed for H=([217.25.236.147]) [217.25.236.147]:59680: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:33:03 dovecot_login authenticator failed for H=(s9Ja5JEx) [178.16.54.138]:52851: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.168.71.109
country_id: 1835841
description:
2026-01-31 10:33:29 dovecot_login authenticator failed for H=([112.168.71.109]) [112.168.71.109]:52250: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:33:29 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 68.221.64.41
country_id: 2510769
domain: lvconsult.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/wp-login.php||SC:/home/lvconsultcom/public_html/wp-admin/images/wp-login.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:33:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:33:05 dovecot_login authenticator failed for H=(hEpwlBGAhX) [158.94.209.22]:58221: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:33:04 dovecot_login authenticator failed for H=(NrQ3Ca) [77.83.39.64]:63191: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:33:59 dovecot_login authenticator failed for H=(YI84KEo) [158.94.209.22]:64339: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 68.221.64.41
country_id: 2510769
domain: lvconsult.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/lvconsultcom/public_html/wp-includes/SimplePie/about.php||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: symphony-led.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2024/index.php||SC:/home/symphonyadmin/public_html/wp-content||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 8.134.159.4
country_id: 1814991
description:
2026-01-31 10:34:24 28239 [Warning] Aborted connection 28239 to db: 'unconnected' user: 'unauthenticated' host: '8.134.159.4' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-01-31 10:34:15 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:34:17 dovecot_login authenticator failed for H=(ALzNDo) [158.94.209.22]:49965: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:34:23 dovecot_login authenticator failed for H=(7itYSiJ) [178.16.54.138]:63773: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.72.235.193
country_id: 2017370
description:
2026-01-31 10:34:44 dovecot_login authenticator failed for H=(4C5E0C0DE7C6.mldns.ru) [109.72.235.193]:37836: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:34:16 dovecot_login authenticator failed for H=(zL7TlRVG5) [77.83.39.64]:54698: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.30.203.223
country_id: 298795
description:
2026-01-31 10:34:30 dovecot_login authenticator failed for H=([176.30.203.223]) [176.30.203.223]:60061: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.199.172.66
country_id: 1814991
description:
2026-01-31 10:34:46 dovecot_login authenticator failed for H=([221.199.172.66]) [221.199.172.66]:35676: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:kcswebtechnologies.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d9ee68ea238f7c630518d3c3663f980b9ba29a87||Title:0xb0711438||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:34:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:35:06 dovecot_login authenticator failed for H=(dTaUE3f1) [77.83.39.64]:60163: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:35:11 dovecot_login authenticator failed for H=(S6SUN9vBN) [158.94.209.22]:53605: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:kcswebtechnologies.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a3a8f8739b82c8d63514c9efd7420f8db0ad5a8c||Title:0xe354a173||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.88.237.152
country_id: 1814991
description:
2026-01-31 10:35:08 dovecot_login authenticator failed for H=(152.237.88.222.broad.ny.ha.dynamic.163data.com.cn) [222.88.237.152]:14778: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:35:17 dovecot_login authenticator failed for H=(Lvnmyg0I) [178.16.54.138]:55983: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:35:45 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:35:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 77.83.39.64


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:kcswebtechnologies.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6c50b988a79ff879a591aefcbd9ed79c2bf21c89||Title:0xed091188||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:36:19 dovecot_login authenticator failed for H=(TbiBDqAaG) [77.83.39.64]:58767: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.52.202.92
country_id: 1814991
description:
2026-01-31 10:36:40 dovecot_login authenticator failed for H=([123.52.202.92]) [123.52.202.92]:33438: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:36:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:36:05 dovecot_login authenticator failed for H=(Pzpocr) [158.94.209.22]:58461: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:36:14 dovecot_login authenticator failed for H=(agVZv5urQ) [178.16.54.138]:51801: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2026-01-31 10:36:31 dovecot_login authenticator failed for H=(nsg-static-145.58.71.182.airtel.in) [27.123.102.50]:46506: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:kcswebtechnologies.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:18c47c41fbd9d2a6260ebc84eda0561401fd2a8d||Title:0x04aaa76a||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:37:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:37:17 dovecot_login authenticator failed for H=(NgVleTuQh1) [158.94.209.22]:53353: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.34.120.78
country_id: 2750405
description:
2026-01-31 10:37:24 dovecot_login authenticator failed for H=78.120.34.34.bc.googleusercontent.com (10.164.0.2) [34.34.120.78]:50398: 535 Incorrect authentication data (set_id=jasonkua@printspecsolution.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:37:08 dovecot_login authenticator failed for H=(9QgVslmgo) [178.16.54.138]:51698: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:37:08 dovecot_login authenticator failed for H=(NZKVNMVUB7) [77.83.39.64]:55914: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:38:29 dovecot_login authenticator failed for H=(qsSuJNmPh) [158.94.209.22]:58842: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:38:25 dovecot_login authenticator failed for H=(zM4yKQkN) [178.16.54.138]:62859: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2026-01-31 10:38:30 dovecot_plain authenticator failed for H=c-98-204-134-124.hsd1.md.comcast.net (reeryoffs) [98.204.134.124]:45362: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:38:11 dovecot_login authenticator failed for H=(FkKN18o) [158.94.209.22]:51765: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:38:22 dovecot_login authenticator failed for H=(BSqCRdA1Um) [77.83.39.64]:57589: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:38:49 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:kcswebtechnologies.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:53cce8328aee7b43d871f07a50a3768a986f3360||Title:0x354c31f3||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:38:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-31 10:39:14 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:56014: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:39:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:39:34 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-31 10:39:07 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:54489: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:39:19 dovecot_login authenticator failed for H=(WBGvrF) [178.16.54.138]:56674: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 10:39:21 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:40434: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2026-01-31 10:39:37 dovecot_plain authenticator failed for H=40.red-81-42-225.staticip.rima-tde.net (trugglyze) [81.42.225.40]:60186: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2026-01-31 10:39:39 dovecot_plain authenticator failed for H=c-24-15-216-41.hsd1.il.comcast.net (pernes) [24.15.216.41]:50620: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:39:12 dovecot_login authenticator failed for H=(aTkJVSH) [77.83.39.64]:57470: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-01-31 10:39:31 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:43918: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:39:02 dovecot_login authenticator failed for H=(40InGO6n2n) [158.94.209.22]:61871: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:kcswebtechnologies.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:22be558b9132cc49dbb1f26f2f2f693098268a51||Title:0xd40b1681||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:39:00 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.73.94
country_id: 1269750
description:
2026-01-31 10:40:48 dovecot_login authenticator failed for H=([125.19.196.193]) [182.78.73.94]:45968: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
country_id: 1269750
description:
2026-01-31 10:40:08 dovecot_login authenticator failed for H=([14.98.28.43]) [14.98.28.43]:59436: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:40:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.42.124.117
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=124214 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.69.219
country_id: 6252001
description:
2026-01-31 10:40:17 dovecot_login authenticator failed for H=([209.23.69.219]) [209.23.69.219]:46328: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:40:17 dovecot_login authenticator failed for H=(RFJY5W0B) [158.94.209.22]:55613: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:40:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:40:04 dovecot_login authenticator failed for H=(jiKOF0B) [77.83.39.64]:51854: 535 Incorrect authentication data (set_id=cky)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:kcswebtechnologies.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8466e04d79f2eab53029128c38417161ef1054a4||Title:0x2e53ec9a||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:40:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:40:10 dovecot_login authenticator failed for H=(92Bekzm) [178.16.54.138]:62343: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 117.207.232.72
country_id: 1269750
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/images/logo.png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:40:35 dovecot_login authenticator failed for H=(VWs2wrY) [158.94.209.22]:53857: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.164.93.136
country_id: 6252001
description:
2026-01-31 10:40:57 dovecot_login authenticator failed for H=(syn-024-164-093-136.res.spectrum.com) [24.164.93.136]:58344: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:kcswebtechnologies.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8e18d905a083c9a2f4cef5030d4acf62378fc909||Title:0x71df0fce||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:41:11 dovecot_login authenticator failed for H=(9911KCEj0F) [158.94.209.22]:61385: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:41:19 dovecot_login authenticator failed for H=(v5816aogL) [77.83.39.64]:60358: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.179.128
country_id: 3996063
description:
2026-01-31 10:41:20 dovecot_login authenticator failed for H=([140.84.179.128]) [140.84.179.128]:55172: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:41:14 dovecot_login authenticator failed for H=(j8vaCPYS) [178.16.54.138]:53356: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:41:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:41:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.55.253.209
country_id: 3865483
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=57011528707507 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.66.63.186
country_id: 1835841
description:
2026-01-31 10:41:01 dovecot_login authenticator failed for H=([121.66.63.186]) [121.66.63.186]:40911: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2026-01-31 10:41:12 dovecot_login authenticator failed for H=(1522312565.colombiatel.co) [152.231.25.64]:50527: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:41:45 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2026-01-31 10:41:47 dovecot_login authenticator failed for H=(m121-202-146-144.smartone.com) [121.202.146.144]:47610: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.223.1.182
country_id: 2017370
description:
2026-01-31 10:42:02 dovecot_login authenticator failed for H=(89-223-1-182.obit.ru) [89.223.1.182]:46329: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:42:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:42:05 dovecot_login authenticator failed for H=(0yP5PTQ) [158.94.209.22]:49701: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:42:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2026-01-31 10:42:46 dovecot_login authenticator failed for H=([222.120.176.6]) [222.120.176.6]:33672: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:kcswebtechnologies.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f6e94ff9e4d129731659cfb495c03e2477318f0d||Title:0x77546d94||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:42:10 dovecot_login authenticator failed for H=(u3qTcq6WU) [77.83.39.64]:64045: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:42:29 dovecot_login authenticator failed for H=(h8aGOu5UC) [158.94.209.22]:51534: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-01-31 10:42:05 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:42:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:42:09 dovecot_login authenticator failed for H=(G70iPbCyi) [178.16.54.138]:64678: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2026-01-31 10:42:43 dovecot_login authenticator failed for H=([83.239.84.130]) [83.239.84.130]:52370: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-01-31 10:43:37 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-01-31 10:43:05 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:49402: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:43:26 dovecot_login authenticator failed for H=(9z3dKTYU) [178.16.54.138]:55015: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:43:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 77.83.39.64


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:kcswebtechnologies.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9db505bb8cc29bf3944790f6382cb14cc65a97e6||Title:0x90a3f61c||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:43:06 dovecot_login authenticator failed for H=(yfviBm3M8i) [158.94.209.22]:49479: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.194
country_id: 1269750
description:
2026-01-31 10:43:58 dovecot_login authenticator failed for H=(nsg-corporate-194.230.187.122.airtel.in) [122.187.230.194]:38167: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:43:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:43:23 dovecot_login authenticator failed for H=(XpiyyR) [77.83.39.64]:62099: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-01-31 10:44:41 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:49550: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:44:24 dovecot_login authenticator failed for H=(2A5I7pXpd) [178.16.54.138]:59965: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:44:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:kcswebtechnologies.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cddacd3b5312227d77d10d558ea1d667ad7046b9||Title:0xde292492||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:44:03 dovecot_login authenticator failed for H=(DwnrPVxf) [158.94.209.22]:62118: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:44:13 dovecot_login authenticator failed for H=(t6wMuYQmz) [77.83.39.64]:56941: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:44:21 dovecot_login authenticator failed for H=(bALIbXg2TD) [158.94.209.22]:55766: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:45:17 dovecot_login authenticator failed for H=(KB4FStdj2A) [178.16.54.138]:59300: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:45:11 dovecot_login authenticator failed for H=(fMcYOx) [77.83.39.64]:55483: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:45:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.203.106
country_id: 1814991
description:
2026-01-31 10:45:50 dovecot_login authenticator failed for H=([122.225.203.106]) [122.225.203.106]:51458: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:kcswebtechnologies.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4df6633f06aa02e10385b718bae13205186b7454||Title:0xa57c0229||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.245.202
country_id: 1814991
description:
2026-01-31 10:45:12 dovecot_login authenticator failed for H=([218.21.245.202]) [218.21.245.202]:33712: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.186.104.101
country_id: 6252001
description:
2026-01-31 10:45:41 dovecot_login authenticator failed for H=wsip-184-186-104-101.lv.lv.cox.net [184.186.104.101]:59995: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 10.1.14.100
description:
Jan 31 10:45:40 sv3 sshd[4011230]: Accepted publickey for root from 10.1.14.100 port 51702 ssh2: RSA SHA256:WdDh84n9i7OwfL83TC4Q9y94bNOmxYGU2yeZfrTsxL0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:45:15 dovecot_login authenticator failed for H=(Sl2T8g5jH) [158.94.209.22]:65357: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:46:13 dovecot_login authenticator failed for H=(QRFFrLF) [178.16.54.138]:55567: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:46:15 dovecot_login authenticator failed for H=(Xj21Tc7) [158.94.209.22]:53150: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:46:20 dovecot_login authenticator failed for H=(aVeu6Qy) [77.83.39.64]:62406: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 176.120.22.61
country_id: 2017370
description:
2026-01-31 10:46:23 28784 [Warning] Aborted connection 28784 to db: 'unconnected' user: 'unauthenticated' host: '176.120.22.61' (This connection closed normally without authentication)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:kcswebtechnologies.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:03e51b31ad4e3b6111e9359d62121408ac2101da||Title:0x9d807ada||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2026-01-31 10:46:07 dovecot_login authenticator failed for H=(nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:48373: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:46:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.36.53
country_id: 1814991
description:
2026-01-31 10:46:30 dovecot_login authenticator failed for H=([61.184.36.58]) [61.184.36.53]:34144: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:47:45 dovecot_login authenticator failed for H=(uHhCmkebJ) [158.94.209.22]:53423: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: dsc-expat.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2024/index.php||SC:/home2/dscexpat/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:47:34 dovecot_login authenticator failed for H=(fwQgK50i) [178.16.54.138]:53364: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.204
country_id: 337996
description:
2026-01-31 10:47:45 dovecot_login authenticator failed for H=([196.191.212.226]) [213.55.85.204]:7293: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.152.240
country_id: 1861060
domain: medinova.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home/medinovacom/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:47:09 dovecot_login authenticator failed for H=(99Aw1E) [158.94.209.22]:59625: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.204.232.244
country_id: 1269750
description:
2026-01-31 10:47:30 dovecot_login authenticator failed for H=(broadband.actcorp.in) [49.204.232.244]:51304: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.242.64.111
country_id: 1814991
description:
2026-01-31 10:47:54 dovecot_login authenticator failed for H=([183.242.64.111]) [183.242.64.111]:51777: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:47:15 dovecot_login authenticator failed for H=(H5p1EfgR4O) [77.83.39.64]:51491: 535 Incorrect authentication data (set_id=cky)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:kcswebtechnologies.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:74d8c9c914dfd0f9eae2c606c528f502d7948e85||Title:0x60c0dddc||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:48:47 dovecot_login authenticator failed for H=(NUrkO8n) [178.16.54.138]:58138: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:48:03 dovecot_login authenticator failed for H=(QiDULXAQS) [158.94.209.22]:51160: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:48:45 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:48:09 dovecot_login authenticator failed for H=(RvmGNRL7) [77.83.39.64]:57356: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2026-01-31 10:48:46 dovecot_login authenticator failed for H=69-172-79-198.static.imsbiz.com ([173.248.234.145]) [69.172.79.198]:55372: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.150
country_id: 1269750
description:
2026-01-31 10:48:02 dovecot_login authenticator failed for H=(nsg-corporate-150.230.187.122.airtel.in) [122.187.230.150]:34907: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:48:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.97.109.192
country_id: 1835841
description:
2026-01-31 10:48:35 dovecot_login authenticator failed for H=([210.97.109.192]) [210.97.109.192]:58375: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:kcswebtechnologies.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:82cdd84cb2da48400f16d91b4158c3eb0a7f9a3f||Title:0x65847d26||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:49:18 dovecot_login authenticator failed for H=(N3Elf3S82) [158.94.209.22]:60254: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:49:19 dovecot_login authenticator failed for H=(I5tlVNQjjH) [77.83.39.64]:50071: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:49:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:49:13 dovecot_login authenticator failed for H=(EHPdi0G) [178.16.54.138]:51720: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:49:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:49:34 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 10:49:41 dovecot_login authenticator failed for H=(dd4GC3Xy) [178.16.54.22]:65268: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 221.121.107.55
country_id: 1694008
domain: achieversvisionacademy.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:kcswebtechnologies.achieversvisionacademy.com||ServerName:achieversvisionacademy.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4b6045f8e31da002217905d571df4b6964f8d6ec||Title:0x54edb0a1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:50:08 dovecot_login authenticator failed for H=(x5xG2ADwNK) [178.16.54.138]:52832: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.64
country_id: 690791
description:
2026-01-31 10:50:10 dovecot_login authenticator failed for H=(fRkc46ztJ) [77.83.39.64]:53510: 535 Incorrect authentication data (set_id=cky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.59.240
country_id: 798544
description:
2026-01-31 10:50:51 dovecot_login authenticator failed for H=(ADMIN) [138.199.59.240]:62099: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.24.199
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2930dc158cb29037795cb04dc9550ccad4f498cc||Title:0x0ac8095b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:50:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:50:12 dovecot_login authenticator failed for H=(1cugji) [158.94.209.22]:62484: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 10:50:13 dovecot_login authenticator failed for H=(jiizQ8) [178.16.54.22]:62437: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.64
country_id: 690791
description:
Jan 31 10:50:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cky has been locked for the attacker IP 77.83.39.64


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:50:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.46
country_id: 1269750
description:
2026-01-31 10:50:24 dovecot_login authenticator failed for H=([182.95.223.46]) [182.95.223.46]:58568: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.181.133.153
country_id: 3469034
description:
2026-01-31 10:50:33 dovecot_login authenticator failed for H=([179.181.133.153]) [179.181.133.153]:36868: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.231.85.75
country_id: 2464461
description:
2026-01-31 10:51:13 dovecot_login authenticator failed for H=([41.231.85.75]) [41.231.85.75]:53509: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:51:24 dovecot_login authenticator failed for H=(xWDuHqPpV2) [158.94.209.22]:53279: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.156.1.127
country_id: 3469034
description:
2026-01-31 10:51:27 dovecot_login authenticator failed for H=([38.156.1.127]) [38.156.1.127]:39599: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 10:51:11 dovecot_login authenticator failed for H=(mJosNKN) [178.16.54.22]:53865: 535 Incorrect authentication data (set_id=limls)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:51:01 dovecot_login authenticator failed for H=(IkA5DzFRRd) [178.16.54.138]:62393: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.24.199
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:dff36a6db53c2967769d4a57ab5004e7b9bf905a||Title:0xcba1ff2e||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:51:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:51:27 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:51:06 dovecot_login authenticator failed for H=(0pNCD90l) [158.94.209.22]:62373: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:52:24 dovecot_login authenticator failed for H=(4miwqiLF) [178.16.54.138]:54023: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.198.68.233
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/translation/Tests/Loader/JsonFileLoaderTest.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-01-31 10:52:14 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:38650: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:52:18 dovecot_login authenticator failed for H=(b8EUmGW57) [158.94.209.22]:62599: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 10:52:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hvoon@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 10:52:30 dovecot_login authenticator failed for H=(SmJs4OL7SW) [178.16.54.22]:54928: 535 Incorrect authentication data (set_id=limls)


plugin: modsec
rule: 77142097
name: IM360 WAF: Track spam via contactform for WordPress
abuser: 185.220.101.8
country_id: 2921044
domain: ms-chemicals.net
description:
IM360 WAF: Track spam via contactform for WordPress||RSV:7.71||T:APACHE||MVN:REQUEST_URI||MV:/wp-json/contact-form-7/v1/contact-forms/6/feedback||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:52:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.234.61.160
country_id: 6252001
description:
2026-01-31 10:52:52 dovecot_login authenticator failed for H=c-71-234-61-160.hsd1.ct.comcast.net ([127.0.0.1]) [71.234.61.160]:35046: 535 Incorrect authentication data (set_id=info@vc-b.com)


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 185.220.101.8
country_id: 2921044
domain: ms-chemicals.net
description:
IM360 WAF: Track spam in PrestaShop||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-json/contact-form-7/v1/contact-forms/6/feedback||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:53:16 dovecot_login authenticator failed for H=(GqPhYTJzm) [178.16.54.138]:60890: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.24.199
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5d0d1984e08269c2b570ab4cc02141cdcded34d2||Title:0x7cb1de4a||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 10:53:06 dovecot_login authenticator failed for H=(eqiiIiKR) [178.16.54.22]:60221: 535 Incorrect authentication data (set_id=limls)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:53:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:53:12 dovecot_login authenticator failed for H=(2Ko7mpzrX) [158.94.209.22]:55655: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 10:54:05 dovecot_login authenticator failed for H=(Z4j9yR1utK) [178.16.54.22]:63851: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:54:10 dovecot_login authenticator failed for H=(iKcN1rcgEP) [178.16.54.138]:61585: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:54:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.148
country_id: 2635167
description:
2026-01-31 10:54:56 29336 [Warning] Aborted connection 29336 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.148' (This connection closed normally without authentication)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 45.134.225.36
country_id: 2921044
domain: vtgroupsb.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/143.0.7499.169 Safari/537.36||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.49
country_id: 2017370
description:
2026-01-31 10:54:24 dovecot_login authenticator failed for H=([178.178.222.49]) [178.178.222.49]:36254: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.24.199
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d8706b0d356a650ef19596d6fb8a9458dd17a701||Title:0x0835fd55||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:54:06 dovecot_login authenticator failed for H=(MGApeUaX) [158.94.209.22]:56312: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.26.113
country_id: 1522867
description:
2026-01-31 10:54:38 dovecot_login authenticator failed for H=2.135.26.113.dynamic.telecom.kz [2.135.26.113]:39861: 535 Incorrect authentication data (set_id=aziz)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.24.199
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3a683d77f344929a0caf4225ffb4d22fad08e96e||Title:0x979aba2e||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:55:18 dovecot_login authenticator failed for H=(gCc8gcnhw) [158.94.209.22]:54417: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:55:36 dovecot_login authenticator failed for H=(Zgp9jM) [158.94.209.22]:50184: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.137.92
country_id: 1835841
domain: garudabay.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home/garudabay/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 10:55:05 dovecot_login authenticator failed for H=(BJXHXG) [178.16.54.138]:59249: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 10:55:13 dovecot_login authenticator failed for H=(cpqmPFx) [178.16.54.22]:64800: 535 Incorrect authentication data (set_id=limls)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.148
country_id: 2635167
description:
2026-01-31 10:56:10 29378 [Warning] Aborted connection 29378 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.148' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:56:12 dovecot_login authenticator failed for H=(1LqkWJ5) [158.94.209.22]:59288: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2026-01-31 10:56:41 dovecot_login authenticator failed for H=(173-25-186-130.client.mchsi.com) [173.25.186.130]:55624: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 10:56:22 dovecot_login authenticator failed for H=(Wi4PXW) [178.16.54.22]:59955: 535 Incorrect authentication data (set_id=limls)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2026-01-31 10:56:33 dovecot_login authenticator failed for H=(90.pool90-173-78.static.orange.es) [90.173.78.90]:54997: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-01-31 10:56:52 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:36912: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.170.126
country_id: 1814991
description:
2026-01-31 10:57:20 dovecot_login authenticator failed for H=([220.180.170.126]) [220.180.170.126]:54029: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.24.199
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:80a668553230cf400b8609aaf5e42dc0021bf508||Title:0xedfe0107||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 10:57:10 dovecot_login authenticator failed for H=(Hlfnd0Qh0w) [178.16.54.22]:64575: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:57:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:57:06 dovecot_login authenticator failed for H=(Xv7rpp01q) [158.94.209.22]:60379: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: agpc.org.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home/agpcorg/public_html/assets||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2026-01-31 10:57:46 dovecot_login authenticator failed for H=([123.129.245.249]) [123.129.245.249]:40425: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.232.114.71
country_id: 3469034
description:
2026-01-31 10:58:57 dovecot_login authenticator failed for H=(189-108-96-183.customer.tdatabrasil.net.br) [200.232.114.71]:43618: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:58:19 dovecot_login authenticator failed for H=(VA18aowkMy) [158.94.209.22]:55599: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.82
country_id: 1269750
description:
2026-01-31 10:58:20 dovecot_login authenticator failed for H=([59.145.212.121]) [182.95.184.82]:49954: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2026-01-31 10:58:49 dovecot_login authenticator failed for H=net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:53010: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-31 10:58:05 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:13053: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 10:58:22 dovecot_login authenticator failed for H=(YDEBAYq) [178.16.54.22]:65282: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.142.48.143
country_id: 2017370
description:
2026-01-31 10:58:13 dovecot_login authenticator failed for H=(213.142.48.143-fttb.planeta.tc) [213.142.48.143]:53481: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:58:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-01-31 10:58:27 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:22308: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 10:59:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.61.40.117
country_id: 3469034
description:
2026-01-31 10:59:13 dovecot_login authenticator failed for H=201-61-40-117.bbone.telesp.net.br (189-44-180-233.customer.tdatabrasil.net.br) [201.61.40.117]:36918: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 10:59:13 dovecot_login authenticator failed for H=(faIErNlI) [178.16.54.22]:58815: 535 Incorrect authentication data (set_id=limls)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:59:31 dovecot_login authenticator failed for H=(gIDgR7mvNT) [158.94.209.22]:65285: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 10:59:13 dovecot_login authenticator failed for H=(mnaDIlgj) [158.94.209.22]:57285: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.24.199
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4b533131e85bbe827754614569d8ec6f7265e53b||Title:0x3347e206||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.148
country_id: 2635167
description:
2026-01-31 10:59:40 29536 [Warning] Aborted connection 29536 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.148' (This connection closed normally without authentication)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.24.199
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c7c2b86334d3f04d1d5688bd01025a6b1518f855||Title:0x93a238ab||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:00:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.126.53.11
country_id: 1835841
description:
2026-01-31 11:00:21 dovecot_login authenticator failed for H=([168.126.53.11]) [168.126.53.11]:52752: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-01-31 11:00:35 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:51384: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:00:42 dovecot_login authenticator failed for H=(Y7RIcWB) [178.16.54.22]:50248: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:00:07 dovecot_login authenticator failed for H=(tPuOSr8aAE) [158.94.209.22]:60367: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-01-31 11:01:59 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:44234: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:01:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:01:19 dovecot_login authenticator failed for H=(2jQym4xt) [158.94.209.22]:62289: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.138
country_id: 2635167
description:
2026-01-31 11:01:21 29590 [Warning] Aborted connection 29590 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.138' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:01:23 dovecot_login authenticator failed for H=(65umVOx) [178.16.54.22]:61839: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.159.71.249
country_id: 1835841
description:
2026-01-31 11:01:49 dovecot_login authenticator failed for H=([121.159.71.249]) [121.159.71.249]:59852: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.24.199
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0c354c715d080762e03af11fdc7c12b913338bc4||Title:0xde845e59||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:02:13 dovecot_login authenticator failed for H=(6onK8R9R3) [158.94.209.22]:50845: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: solidfence.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/solidfencecom/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-31 11:02:11 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:49858: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:02:21 dovecot_login authenticator failed for H=(aUDr9Vu9Z) [178.16.54.22]:56894: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.17.6.119
country_id: 1814991
description:
2026-01-31 11:02:40 dovecot_login authenticator failed for H=(119.6.17.58.adsl-pool.jx.chinaunicom.com) [58.17.6.119]:35500: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: langkawiconstructions.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/lkwconstructions/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-01-31 11:02:55 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:55062: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: langkawiconstructions.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home2/lkwconstructions/public_html/wp-content/uploads/index.php||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.121.206
country_id: 1733045
description:
[2026-01-31 11:03:31 +0800] info [webmaild] 113.211.121.206 - felicia@nexuscollection.com "POST /cpsess2582928648/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [113.211.133.31] != Current IP Address [113.211.121.206]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.131.13.235
country_id: 3175395
description:
2026-01-31 11:03:38 dovecot_plain authenticator failed for H=vps-2ad1c31b.vps.ovh.net (WIN-V2L96PKQFU1.openstacklocal) [57.131.13.235]:53581: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.222.112.45
country_id: 1269750
description:
2026-01-31 11:03:04 dovecot_login authenticator failed for H=(static.ill.117.247.82.240.bsnl.co.in) [117.222.112.45]:50796: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:03:43 dovecot_login authenticator failed for H=(WNWwRaNLF) [158.94.209.22]:56698: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.24.199
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2a226fe1f84b2da6b0544df2620762cd53fa5066||Title:0x00ce54bc||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2026-01-31 11:03:49 dovecot_login authenticator failed for H=([182.66.214.70]) [182.66.214.70]:41156: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:03:07 dovecot_login authenticator failed for H=(XOQru5Y7n) [178.16.54.22]:61586: 535 Incorrect authentication data (set_id=limls)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:03:07 dovecot_login authenticator failed for H=(JClsCd2pn) [158.94.209.22]:63909: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.243
country_id: 1814991
description:
2026-01-31 11:03:23 dovecot_login authenticator failed for H=([111.61.176.243]) [111.61.176.243]:30120: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.37.39.221
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/egulias/email-validator/EmailValidator/EmailParser.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.125.200
country_id: 294640
description:
2026-01-31 11:03:51 dovecot_login authenticator failed for H=(2-55-125-200.orange.net.il) [2.55.125.200]:36126: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.16.103.46
country_id: 2017370
description:
2026-01-31 11:04:14 dovecot_login authenticator failed for H=([62.16.103.46]) [62.16.103.46]:53681: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.17.38
country_id: 3469034
description:
2026-01-31 11:04:44 dovecot_login authenticator failed for H=([186.239.246.145]) [187.8.17.38]:59872: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.35.66.245
country_id: 6252001
description:
2026-01-31 11:04:15 dovecot_login authenticator failed for H=([4.35.66.245]) [4.35.66.245]:48304: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.166.176.136
country_id: 2139685
description:
2026-01-31 11:04:31 dovecot_login authenticator failed for H=host-202-166-176-136.static.lagoon.nc [202.166.176.136]:32890: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:04:01 dovecot_login authenticator failed for H=(R1KktTB8) [158.94.209.22]:54224: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: visoft.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home/visoftcom/public_html/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-01-31 11:04:10 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:54876: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:04:13 dovecot_login authenticator failed for H=(8R3r6vzH) [178.16.54.22]:56365: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.4.15.134
country_id: 3469034
domain: plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/plomalite.com/shop-single.php?id=4724 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:05:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.24.199
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6b4a2e22ce80f4dad635a8b7364a97497f78b2c4||Title:0xab5f8a54||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:05:13 dovecot_login authenticator failed for H=(f0Glnq8) [158.94.209.22]:57274: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.131.13.235
country_id: 3175395
description:
2026-01-31 11:05:58 dovecot_plain authenticator failed for H=vps-2ad1c31b.vps.ovh.net (WIN-V2L96PKQFU1.openstacklocal) [57.131.13.235]:53972: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:05:17 dovecot_login authenticator failed for H=(zhuwlmj94) [178.16.54.138]:60276: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:05:22 dovecot_login authenticator failed for H=(vOlhd65OW5) [178.16.54.22]:59354: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.138
country_id: 2635167
description:
2026-01-31 11:06:14 29743 [Warning] Aborted connection 29743 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.138' (This connection closed normally without authentication)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.24.199
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4d7a9f24766d2a4117e3316e0cdb17e8ddb9af20||Title:0xdeff53f6||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.131.13.235
country_id: 3175395
description:
2026-01-31 11:06:04 dovecot_login authenticator failed for H=vps-2ad1c31b.vps.ovh.net (WIN-V2L96PKQFU1.openstacklocal) [57.131.13.235]:53972: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:06:07 dovecot_login authenticator failed for H=(WzTH6PPuye) [158.94.209.22]:51739: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:06:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:06:09 dovecot_login authenticator failed for H=(F7O7lj) [178.16.54.138]:57339: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:07:06 dovecot_login authenticator failed for H=(QAjsfPu6L) [178.16.54.22]:51439: 535 Incorrect authentication data (set_id=limls)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:07:55 dovecot_login authenticator failed for H=(YA2LTJCp) [158.94.209.22]:49727: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:07:01 dovecot_login authenticator failed for H=(mfe3f40WGz) [158.94.209.22]:63666: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:07:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.108.13
country_id: 1814991
description:
2026-01-31 11:07:29 dovecot_login authenticator failed for H=([119.6.108.13]) [119.6.108.13]:49333: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.24.199
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:eb9aaf3a7c2ab3770a73cdffdea28996eaf7869d||Title:0x81fc3a47||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:07:01 dovecot_login authenticator failed for H=(k0nlEcz1T) [178.16.54.138]:60892: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2026-01-31 11:07:09 dovecot_login authenticator failed for H=(82.193.122.91.cl.ipnet.ua) [82.193.122.91]:42449: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 5.34.240.185
country_id: 453733
domain: agsaintifik.com.my
description:
IM360 WAF: Track spam in PrestaShop||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-json/contact-form-7/v1/contact-forms/38/feedback||


plugin: modsec
rule: 77142097
name: IM360 WAF: Track spam via contactform for WordPress
abuser: 5.34.240.185
country_id: 453733
domain: agsaintifik.com.my
description:
IM360 WAF: Track spam via contactform for WordPress||RSV:7.71||T:APACHE||MVN:REQUEST_URI||MV:/wp-json/contact-form-7/v1/contact-forms/38/feedback||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.148.10
country_id: 1814991
description:
2026-01-31 11:08:02 dovecot_login authenticator failed for H=(hebei.18.121.in-addr.arpa) [121.18.148.10]:31816: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:08:08 dovecot_login authenticator failed for H=(PSeuuep) [178.16.54.22]:53040: 535 Incorrect authentication data (set_id=limls)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.236.133.222
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=81&page=2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.118.162.194
country_id: 2453866
description:
2026-01-31 11:08:36 dovecot_login authenticator failed for H=([154.118.162.194]) [154.118.162.194]:41511: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:08:13 dovecot_login authenticator failed for H=(p4Mef7RNTq) [158.94.209.22]:49518: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-01-31 11:08:15 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:55282: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-01-31 11:08:28 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:12858: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:08:20 dovecot_login authenticator failed for H=(28ociG) [178.16.54.138]:53678: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2026-01-31 11:08:27 dovecot_login authenticator failed for H=(1522312565.colombiatel.co) [152.231.25.64]:44129: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.24.199
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5fe9cb3079774341df36576d764f7f787861987e||Title:0xab8b03ef||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:08:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:09:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-01-31 11:09:13 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:59058: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.72.200
country_id: 2017370
description:
2026-01-31 11:09:23 dovecot_login authenticator failed for H=broadband-188-32-72-200.ip.moscow.rt.ru [188.32.72.200]:53840: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.138
country_id: 2635167
description:
2026-01-31 11:09:47 29946 [Warning] Aborted connection 29946 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.138' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.144.79.102
country_id: 1269750
description:
2026-01-31 11:09:15 dovecot_login authenticator failed for H=(aes-static-102.79.144.59.airtel.in) [59.144.79.102]:48340: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:09:17 dovecot_login authenticator failed for H=(bXNvrMtVJ) [178.16.54.138]:56197: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 11:09:41 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bkooi@mckd.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:09:24 dovecot_login authenticator failed for H=(D6whHRJd) [178.16.54.22]:58030: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:09:07 dovecot_login authenticator failed for H=(bzFuIR) [158.94.209.22]:50653: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:10:01 dovecot_login authenticator failed for H=(6jsnXnZ4Th) [158.94.209.22]:53554: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.24.199
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fba70dae29fff5699b36c2958ca35edf8b5cb6ed||Title:0xf8886b68||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:10:10 dovecot_login authenticator failed for H=(YY7gGIyy) [178.16.54.138]:61402: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2026-01-31 11:10:16 dovecot_login authenticator failed for H=(nsg-corporate-58.202.186.122.airtel.in) [122.186.202.58]:60790: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:10:46 dovecot_login authenticator failed for H=(WBHLCctCv) [178.16.54.22]:54363: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-01-31 11:10:47 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:35271: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 11:10:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bkooi@mckd.com.my has been locked for the attacker IP 178.16.54.138


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.50.179.247
country_id: 3624060
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=603392 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.123.104.100
country_id: 1168579
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/translation/Tests/fixtures/encoding.xlf HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.213
country_id: 1269750
description:
2026-01-31 11:10:23 dovecot_login authenticator failed for H=([122.187.230.213]) [122.187.230.213]:48399: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.254.92
country_id: 3865483
description:
2026-01-31 11:10:40 dovecot_login authenticator failed for H=(static.90.254.104.190.cps.com.ar) [190.104.254.92]:45411: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.185.173.167
country_id: 1814991
description:
2026-01-31 11:11:12 dovecot_login authenticator failed for H=([110.185.173.167]) [110.185.173.167]:52840: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.21
country_id: 337996
description:
2026-01-31 11:11:14 dovecot_login authenticator failed for H=([196.188.187.21]) [196.188.187.21]:41528: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:11:13 dovecot_login authenticator failed for H=(TGuZGh2Wvb) [158.94.209.22]:55307: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.178
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/css/all.min.css?ver=6.6.4 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 11:11:21 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:33792: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.226.224.102
country_id: 3865483
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/portfolios/emerald-9/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:11:03 dovecot_login authenticator failed for H=(fhet3exk) [178.16.54.138]:55638: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
country_id: 2635167
description:
2026-01-31 11:11:03 dovecot_login authenticator failed for H=(165-220-169-113.cust.exede.net) [165.220.169.113]:49316: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 11:11:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bkooi@mckd.com.my has been locked for the attacker IP 178.16.54.138


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.24.199
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ad4ad3a53eaf59dc3ef652bf49a70415514b6ffb||Title:0xd5c2f0b3||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.123
country_id: 1269750
description:
2026-01-31 11:11:26 dovecot_login authenticator failed for H=(nsg-corporate-123.230.187.122.airtel.in) [122.187.230.123]:48160: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:11:26 dovecot_login authenticator failed for H=(ks8kZN) [178.16.54.22]:58711: 535 Incorrect authentication data (set_id=limls)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:12:59 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:12:07 dovecot_login authenticator failed for H=(o2TYL1) [158.94.209.22]:58064: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 11:12:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bkooi@mckd.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:12:25 dovecot_login authenticator failed for H=(iN3rqQ4i) [158.94.209.22]:59428: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.196.96
country_id: 3469034
description:
2026-01-31 11:12:45 dovecot_login authenticator failed for H=(96.196.181.45.datasysteminfor.com.br) [45.181.196.96]:55603: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.164.51.149
country_id: 732800
description:
[2026-01-31 11:12:58 +0800] info [webmaild] 95.164.51.149 - intercessors@agpc.org.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:12:02 dovecot_login authenticator failed for H=(KRA81tjBE) [178.16.54.22]:64186: 535 Incorrect authentication data (set_id=limls)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:12:22 dovecot_login authenticator failed for H=(vp5kSo4h) [178.16.54.138]:53344: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: solidfence.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/solidfencecom/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: af-sb.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home/afsb/public_html/wp-admin/images/file.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:13:01 dovecot_login authenticator failed for H=(RGyZ5R) [158.94.209.22]:60221: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 11:13:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bkooi@mckd.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:13:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:13:19 dovecot_login authenticator failed for H=(WYn9EoE) [178.16.54.138]:64542: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:13:26 dovecot_login authenticator failed for H=(eE31sB) [178.16.54.22]:52263: 535 Incorrect authentication data (set_id=limls)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.91.67
country_id: 1814991
description:
2026-01-31 11:13:03 dovecot_login authenticator failed for H=([39.164.91.67]) [39.164.91.67]:38166: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:14:13 dovecot_login authenticator failed for H=(E8uh24MF) [178.16.54.138]:59034: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2026-01-31 11:14:53 dovecot_login authenticator failed for H=([125.20.249.39]) [128.185.214.78]:35886: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:14:13 dovecot_login authenticator failed for H=(p70uN67) [158.94.209.22]:63491: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.228.237.90
country_id: 1814991
description:
2026-01-31 11:15:01 dovecot_login authenticator failed for H=([221.228.237.90]) [221.228.237.90]:61792: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:14:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 11:14:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bkooi@mckd.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:14:13 dovecot_login authenticator failed for H=(qtVBRfRQbP) [178.16.54.22]:64135: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.129.96.2
country_id: 1814991
description:
2026-01-31 11:15:28 dovecot_login authenticator failed for H=([219.129.96.2]) [219.129.96.2]:46547: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:15:05 dovecot_login authenticator failed for H=(1Sxv4t) [178.16.54.138]:65501: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:15:07 dovecot_login authenticator failed for H=(nDE626HY) [158.94.209.22]:58212: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.161.196.5
country_id: 99237
description:
2026-01-31 11:15:15 dovecot_login authenticator failed for H=([46.161.196.5]) [46.161.196.5]:59450: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:76936.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:30643cbdcfa5615feaba6dfb2a02aacaea4a477f||Title:0xe0ed505c||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:15:19 dovecot_login authenticator failed for H=(Bg4AobmJZ) [178.16.54.22]:62161: 535 Incorrect authentication data (set_id=limls)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:15:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.166.105.133
country_id: 1814991
description:
2026-01-31 11:15:11 dovecot_login authenticator failed for H=([223.166.105.133]) [223.166.105.133]:40322: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.55.123.178
country_id: 3865483
domain: langkawiconstructions.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/langkawiconstructions.com/contact-us HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.130
country_id: 1269750
description:
2026-01-31 11:15:43 dovecot_login authenticator failed for H=(nsg-corporate-130.230.187.122.airtel.in) [122.187.230.130]:60339: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.85.44.247
country_id: 6252001
description:
2026-01-31 11:15:45 dovecot_plain authenticator failed for H=(ofing) [73.85.44.247]:41484: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.65.169
country_id: 2328926
description:
2026-01-31 11:15:47 dovecot_login authenticator failed for H=(ADMIN) [146.70.65.169]:28414: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:16:37 dovecot_login authenticator failed for H=(Tqv7fi) [158.94.209.22]:62286: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.217.68.100
country_id: 1814991
description:
2026-01-31 11:16:45 dovecot_login authenticator failed for H=([171.217.68.100]) [171.217.68.100]:53410: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-01-31 11:16:53 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:39317: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:16:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:16:39 dovecot_login authenticator failed for H=(HXyNOm) [178.16.54.22]:64767: 535 Incorrect authentication data (set_id=kywong.fpp@vc-b.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:16:19 dovecot_login authenticator failed for H=(BA2i5q1) [158.94.209.22]:64337: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:16:21 dovecot_login authenticator failed for H=(JlPvV9RU) [178.16.54.138]:60831: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.193.149
country_id: 1643084
description:
2026-01-31 11:16:30 dovecot_login authenticator failed for H=([103.186.193.149]) [103.186.193.149]:47372: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:17:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.96.62.29
country_id: 1269750
description:
2026-01-31 11:17:29 dovecot_login authenticator failed for H=([59.96.62.29]) [59.96.62.29]:52368: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-31 11:17:34 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:36646: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2026-01-31 11:17:15 dovecot_login authenticator failed for H=ool-457e901e.dyn.optonline.net [69.126.144.30]:51016: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-31 11:17:07 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:45020: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:17:13 dovecot_login authenticator failed for H=(GM0hrI) [158.94.209.22]:54886: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:17:15 dovecot_login authenticator failed for H=(pnZOFVS4oN) [178.16.54.138]:56244: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:17:17 dovecot_login authenticator failed for H=(9iyJ1oUv) [178.16.54.22]:65267: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:18:10 dovecot_login authenticator failed for H=(jMjrMb) [178.16.54.138]:58982: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:18:12 dovecot_login authenticator failed for H=(lyZV8sSCe) [178.16.54.22]:60459: 535 Incorrect authentication data (set_id=kywong.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2026-01-31 11:18:37 dovecot_login authenticator failed for H=(nsg-corporate-54.222.187.122.airtel.in) [122.187.222.54]:41724: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:18:07 dovecot_login authenticator failed for H=(muVA7R5krG) [158.94.209.22]:50135: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.120.69.143
country_id: 3144096
domain: gagasanteguh.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/admin/upload/css.php||SC:/home2/gagasanteguhcom/public_html/admin/upload||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: jpack.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/jpackcom/public_html/wp-admin||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 11:19:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bkooi@mckd.com.my has been locked for the attacker IP 178.16.54.138


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.197.75.18
country_id: 2077456
domain: inter-link.edu.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/test.php||SC:/home2/interlink/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:19:03 dovecot_login authenticator failed for H=(QaFUBSBOlQ) [178.16.54.22]:50251: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.120.69.143
country_id: 3144096
domain: gagasanteguh.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/wp-login.php||SC:/home2/gagasanteguhcom/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:19:04 dovecot_login authenticator failed for H=(ISHNaDiAoQ) [178.16.54.138]:62278: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.241.122.126
country_id: 6252001
description:
2026-01-31 11:19:38 dovecot_plain authenticator failed for H=([10.27.18.222]) [151.241.122.126]:22702: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 51.120.69.143
country_id: 3144096
domain: gagasanteguh.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/gagasanteguhcom/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:19:19 dovecot_login authenticator failed for H=(sWNOCEfV) [158.94.209.22]:64477: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.23.95.14
country_id: 1814991
description:
2026-01-31 11:21:00 dovecot_login authenticator failed for H=([218.23.95.14]) [218.23.95.14]:60804: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:20:02 dovecot_login authenticator failed for H=(RXPmQX9gRh) [178.16.54.22]:53044: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.241.122.126
country_id: 6252001
description:
2026-01-31 11:20:09 dovecot_plain authenticator failed for H=([10.27.18.222]) [151.241.122.126]:23783: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.120.69.143
country_id: 3144096
domain: gagasanteguh.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/about.php||SC:/home2/gagasanteguhcom/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:20:13 dovecot_login authenticator failed for H=(KyH2vl) [158.94.209.22]:54919: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:20:47 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 11:20:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bkooi@mckd.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:20:25 dovecot_login authenticator failed for H=(K1cF7nf) [178.16.54.138]:51338: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:20:31 dovecot_login authenticator failed for H=(BWENuSw) [158.94.209.22]:60181: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:21:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.155.146.33
country_id: 2017370
description:
2026-01-31 11:21:07 dovecot_login authenticator failed for H=(ip-45-155-146-33.ip.asarta.ru) [45.155.146.33]:57750: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:21:07 dovecot_login authenticator failed for H=(7uQjaFt3) [158.94.209.22]:60492: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:21:02 dovecot_login authenticator failed for H=(OGOBwD8rI7) [178.16.54.22]:49485: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 11:21:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bkooi@mckd.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:21:19 dovecot_login authenticator failed for H=(wpYyB4dXT) [178.16.54.138]:56348: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:22:12 dovecot_login authenticator failed for H=(ONTH0cXL) [178.16.54.22]:56328: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 11:22:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bkooi@mckd.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:22:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.188
country_id: 1814991
description:
2026-01-31 11:22:46 dovecot_login authenticator failed for H=([111.61.177.188]) [111.61.177.188]:33194: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.137.92
country_id: 1835841
domain: vmsmotorsports.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home/vmsadmin/public_html/assets||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-01-31 11:22:10 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:55684: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:22:15 dovecot_login authenticator failed for H=(pkecla) [178.16.54.138]:58205: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:22:19 dovecot_login authenticator failed for H=(vef1pxxFy) [158.94.209.22]:57891: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 11:23:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bkooi@mckd.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:23:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-01-31 11:23:13 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:36510: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:23:13 dovecot_login authenticator failed for H=(rrMciNoW) [158.94.209.22]:53124: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:23:27 dovecot_login authenticator failed for H=(RHNKJvAm) [178.16.54.22]:60834: 535 Incorrect authentication data (set_id=kywong.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:23:14 dovecot_login authenticator failed for H=(VAq97gk) [178.16.54.138]:61220: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 31 11:23:41 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account limls@essemgroup.net has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:24:03 dovecot_login authenticator failed for H=(Kx20Gm) [178.16.54.22]:64555: 535 Incorrect authentication data (set_id=kywong.fpp@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 31 11:24:46 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account limls@essemgroup.net has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-01-31 11:24:54 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:57616: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:24:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:24:07 dovecot_login authenticator failed for H=(raIuZh) [158.94.209.22]:56735: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:24:43 dovecot_login authenticator failed for H=(ozVA0hN) [158.94.209.22]:54089: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:25:19 dovecot_login authenticator failed for H=(Z9r1SAU) [158.94.209.22]:55985: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:25:33 dovecot_login authenticator failed for H=(f7zfNq5L) [178.16.54.22]:52856: 535 Incorrect authentication data (set_id=kywong.fpp@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 31 11:25:44 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account limls@essemgroup.net has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:25:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-01-31 11:25:28 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:35277: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:25:04 dovecot_login authenticator failed for H=(X4BUUHROr) [178.16.54.138]:55081: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:26:08 dovecot_login authenticator failed for H=(okCwAHrJx) [178.16.54.22]:61757: 535 Incorrect authentication data (set_id=kywong.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.42.47.150
country_id: 1835841
description:
2026-01-31 11:26:33 dovecot_login authenticator failed for H=([14.42.47.150]) [14.42.47.150]:31797: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 31 11:26:39 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account limls@essemgroup.net has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.106
country_id: 1269750
description:
2026-01-31 11:26:43 dovecot_login authenticator failed for H=(nsg-corporate-121.229.185.122.airtel.in) [122.186.202.106]:39088: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:26:53 dovecot_login authenticator failed for H=(LWLoUU) [178.16.54.138]:59562: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:26:13 dovecot_login authenticator failed for H=(gITEoj) [158.94.209.22]:62180: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.180.72
country_id: 2017370
description:
2026-01-31 11:26:45 dovecot_login authenticator failed for H=a217-29-180-72.pppoe.mark-itt.net [217.29.180.72]:53162: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.61.48.234
country_id: 1835841
description:
2026-01-31 11:26:55 dovecot_login authenticator failed for H=([125.61.48.234]) [125.61.48.234]:50401: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.168
country_id: 1269750
description:
2026-01-31 11:27:50 dovecot_login authenticator failed for H=(nsg-corporate-168.229.187.122.airtel.in) [122.187.229.168]:37424: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 158.158.35.58
country_id: 2510769
domain: m.solidfence.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/cabecom/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:27:08 dovecot_login authenticator failed for H=(OYq4RvEvJp) [178.16.54.22]:64457: 535 Incorrect authentication data (set_id=kywong.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2026-01-31 11:27:28 dovecot_login authenticator failed for H=([74.208.177.56]) [74.208.177.56]:33414: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:27:30 dovecot_login authenticator failed for H=(aVXIF2IfMa) [2.58.56.77]:59070: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:27:07 dovecot_login authenticator failed for H=(su5JvwIIG9) [158.94.209.22]:51422: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:27:19 dovecot_login authenticator failed for H=(kV239OSd) [178.16.54.138]:65353: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.233.117.109
country_id: 3469034
description:
2026-01-31 11:27:44 dovecot_login authenticator failed for H=([186.233.117.109]) [186.233.117.109]:42562: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.86.4
country_id: 1814991
description:
2026-01-31 11:28:05 dovecot_login authenticator failed for H=([60.174.86.4]) [60.174.86.4]:60519: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.123.109.43
country_id: 732800
description:
2026-01-31 11:28:06 dovecot_login authenticator failed for H=(ADMIN) [93.123.109.43]:54044: 535 Incorrect authentication data (set_id=lowkeesen@nobledec.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.5
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/cache/man/pt_PT/index.db||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2026-01-31 11:28:39 dovecot_login authenticator failed for H=([182.95.226.118]) [182.95.226.118]:53730: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:28:06 dovecot_login authenticator failed for H=(HkUZbHQYyt) [178.16.54.22]:62391: 535 Incorrect authentication data (set_id=kywong.fpp@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:28:36 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 11:28:10 dovecot_login authenticator failed for H=(lnW3ZOfjFN) [178.16.54.138]:58385: 535 Incorrect authentication data (set_id=bkooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.140.234.114
country_id: 2017370
description:
2026-01-31 11:28:46 dovecot_login authenticator failed for H=([62.140.234.114]) [62.140.234.114]:56759: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.203
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/cache/man/pt_BR/index.db||User:root||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:28:56 dovecot_login authenticator failed for H=(UhdJYnq) [158.94.209.22]:54911: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:28:02 dovecot_login authenticator failed for H=(GLonad7cS) [158.94.209.22]:52355: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 158.158.35.58
country_id: 2510769
domain: m.solidfence.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/index.php||SC:/home2/cabecom/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:28:20 dovecot_login authenticator failed for H=(ZX04DJE8) [2.58.56.77]:49534: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.132.164.25
country_id: 2635167
description:
2026-01-31 11:28:36 dovecot_login authenticator failed for H=(ADMIN) [23.132.164.25]:51238: 535 Incorrect authentication data (set_id=rajanazrul@essemgroup.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 175.177.178.1
country_id: 1861060
domain: autogreastar.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:test01.autogreastar.com.my||ServerName:autogreastar.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e71c6710f020493fcedae0122fa4314a2ecd9201||Title:0x1c8c5b6a||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.122.98
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.0.0 Safari/537.36||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:29:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:29:14 dovecot_login authenticator failed for H=(7BsvLDO7) [158.94.209.22]:58550: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.118
country_id: 1149361
description:
2026-01-31 11:29:47 dovecot_login authenticator failed for H=([149.54.62.118]) [149.54.62.118]:50056: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:29:11 dovecot_login authenticator failed for H=(FIq4p9KJ) [178.16.54.22]:62795: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.166.62
country_id: 2017370
description:
2026-01-31 11:29:34 dovecot_login authenticator failed for H=(dynamicip-109-195-166-62.pppoe.ryazan.ertelecom.ru) [109.195.166.62]:60276: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:30:08 dovecot_login authenticator failed for H=(osecXeKi) [2.58.56.77]:53955: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 11:30:59 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:65041: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:30:04 dovecot_login authenticator failed for H=(BYkGPZIYXT) [178.16.54.22]:52948: 535 Incorrect authentication data (set_id=kywong.fpp@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:30:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:30:08 dovecot_login authenticator failed for H=(JzONwK) [158.94.209.22]:63113: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:31:04 dovecot_login authenticator failed for H=(YBnERZ27) [178.16.54.22]:51748: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:31:23 dovecot_login authenticator failed for H=(ZIAz7ANRY) [2.58.56.77]:50986: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2026-01-31 11:31:02 dovecot_login authenticator failed for H=(nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:52992: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:31:02 dovecot_login authenticator failed for H=(zGVcXf9ckq) [158.94.209.22]:58714: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-31 11:31:27 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:22733: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-31 11:31:52 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:59405: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.11
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/depmod.d/dist.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.241.150.246
country_id: 2017370
description:
2026-01-31 11:32:03 dovecot_login authenticator failed for H=91-241-150-246-dyn.neotele.com.ru [91.241.150.246]:36238: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:32:10 dovecot_login authenticator failed for H=(m2Rtld0yGM) [2.58.56.77]:59630: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:32:40 dovecot_login authenticator failed for H=(zY1y6mKNaK) [178.16.54.22]:55628: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:32:14 dovecot_login authenticator failed for H=(fGFQkr) [158.94.209.22]:52938: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.5
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/nsswitch.conf.bak||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
country_id: 1814991
description:
2026-01-31 11:33:59 dovecot_login authenticator failed for H=([39.165.183.70]) [39.165.183.70]:34466: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:33:08 dovecot_login authenticator failed for H=(9iJVOn) [158.94.209.22]:51088: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:33:15 dovecot_login authenticator failed for H=(d7vYLceHKN) [2.58.56.77]:50040: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:33:26 dovecot_login authenticator failed for H=(VKpphe1) [158.94.209.22]:50371: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2026-01-31 11:33:39 dovecot_login authenticator failed for H=([83.239.84.130]) [83.239.84.130]:45608: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:34:00 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:33:16 dovecot_login authenticator failed for H=(pH7EUkvNhl) [178.16.54.22]:59835: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.87
country_id: 1269750
description:
2026-01-31 11:33:24 dovecot_login authenticator failed for H=(nsg-corporate-87.229.187.122.airtel.in) [122.187.229.87]:60312: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:34:24 dovecot_login authenticator failed for H=(guSZrWzg) [178.16.54.22]:52522: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:34:24 dovecot_login authenticator failed for H=(ujmWUHZZJ) [2.58.56.77]:57143: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-31 11:34:36 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:18717: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:34:02 dovecot_login authenticator failed for H=(pOf3Ep) [158.94.209.22]:64716: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
country_id: 1814991
description:
2026-01-31 11:34:22 dovecot_login authenticator failed for H=([111.61.177.190]) [111.61.177.190]:58778: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:34:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
country_id: 1814991
description:
2026-01-31 11:34:21 dovecot_login authenticator failed for H=([39.165.183.70]) [39.165.183.70]:37954: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: kainanholding.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home2/kainanholding/public_html/assets/images||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.182
country_id: 2750405
description:
2026-01-31 11:35:01 30962 [Warning] Aborted connection 30962 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.182' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:35:09 dovecot_login authenticator failed for H=(CW8qbc) [2.58.56.77]:53856: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:35:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:35:14 dovecot_login authenticator failed for H=(Q6pVdBZ1u) [158.94.209.22]:53136: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 11:35:29 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:35:46 dovecot_login authenticator failed for H=(th98DpM) [178.16.54.22]:52693: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 11:36:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:36:04 dovecot_login authenticator failed for H=(jSJzkope) [178.16.54.22]:54894: 535 Incorrect authentication data (set_id=kywong.fpp@vc-b.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.171.101.26
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=2483 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:36:16 dovecot_login authenticator failed for H=(ZVW7gU085A) [2.58.56.77]:60655: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.232.48.252
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/activity-details.php?id=894765 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:36:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:36:08 dovecot_login authenticator failed for H=(GwhQU4ufO5) [158.94.209.22]:65312: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.137.92
country_id: 1835841
domain: aircarbonic.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home2/aircarbonicadmin/public_html/assets||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:37:03 dovecot_login authenticator failed for H=(6ZGsBn) [2.58.56.77]:64130: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 11:37:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:37:20 dovecot_login authenticator failed for H=(tFj6Yg) [158.94.209.22]:52606: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:37:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2026-01-31 11:37:36 dovecot_login authenticator failed for H=(vtx-b-124-014.virtex.com.br) [179.125.124.14]:33121: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2026-01-31 11:37:51 dovecot_login authenticator failed for H=([182.78.79.134]) [182.78.79.134]:48854: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:37:02 dovecot_login authenticator failed for H=(SGVyQIN) [158.94.209.22]:64208: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:37:07 dovecot_login authenticator failed for H=(j6YAuIaV) [178.16.54.22]:51830: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:38:14 dovecot_login authenticator failed for H=(qSdKJhofRh) [178.16.54.22]:54887: 535 Incorrect authentication data (set_id=kywong.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:38:15 dovecot_login authenticator failed for H=(X9BupTtX) [2.58.56.77]:63629: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: cordage.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/admincordage/public_html/images/index.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:38:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 11:38:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:38:14 dovecot_login authenticator failed for H=(QA3Lmk) [158.94.209.22]:53713: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.22.107.51
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=76&page=2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.241.177.181
country_id: 3469034
description:
2026-01-31 11:39:01 dovecot_login authenticator failed for H=(ADMIN) [188.241.177.181]:30877: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:39:08 dovecot_login authenticator failed for H=(0l0gun) [158.94.209.22]:63279: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.222
country_id: 1269750
description:
2026-01-31 11:39:52 dovecot_login authenticator failed for H=(nsg-corporate-222.230.187.122.airtel.in) [122.187.230.222]:55961: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.55.57
country_id: 1814991
description:
2026-01-31 11:39:11 dovecot_login authenticator failed for H=([119.6.55.57]) [119.6.55.57]:41168: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2026-01-31 11:39:22 dovecot_login authenticator failed for H=24-119-144-86.cpe.sparklight.net [24.119.144.86]:40200: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:39:02 dovecot_login authenticator failed for H=(dSWZp01) [2.58.56.77]:53543: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:39:20 dovecot_login authenticator failed for H=(ELs787Nt) [178.16.54.22]:63914: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 11:39:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.63.87
country_id: 1814991
description:
2026-01-31 11:39:23 dovecot_login authenticator failed for H=([111.26.63.87]) [111.26.63.87]:40012: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:40:12 dovecot_login authenticator failed for H=(Dx0UPkU) [2.58.56.77]:63783: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.137.92
country_id: 1835841
domain: astlog.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home/astlogc/public_html/assets||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:40:02 dovecot_login authenticator failed for H=(ZfxGHBAp) [158.94.209.22]:61285: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:40:38 dovecot_login authenticator failed for H=(NDYEIfm6) [178.16.54.22]:56862: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:41:32 dovecot_login authenticator failed for H=(42WKdR) [158.94.209.22]:53218: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 11:41:42 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:32838: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:41:02 dovecot_login authenticator failed for H=(DLUF9P) [2.58.56.77]:54865: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:41:14 dovecot_login authenticator failed for H=(Kfr8dG) [158.94.209.22]:62003: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.196.134
country_id: 1814991
description:
2026-01-31 11:41:32 dovecot_login authenticator failed for H=([220.189.196.134]) [220.189.196.134]:60424: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:41:48 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.82.135.154
country_id: 1814991
description:
2026-01-31 11:41:52 dovecot_login authenticator failed for H=([1.82.135.154]) [1.82.135.154]:35213: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:41:53 dovecot_login authenticator failed for H=(fJ7NhX) [178.16.54.22]:58900: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.194.231.72
country_id: 1814991
description:
2026-01-31 11:41:21 dovecot_login authenticator failed for H=([111.206.233.34]) [111.194.231.72]:50583: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.137.92
country_id: 1835841
domain: thinkcloud.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/thinkcloudadmin/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:42:08 dovecot_login authenticator failed for H=(H9RsCv) [158.94.209.22]:49304: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:42:17 dovecot_login authenticator failed for H=(HKDgQc) [2.58.56.77]:51372: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:42:21 dovecot_login authenticator failed for H=(XR2sEl) [178.16.54.22]:55260: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:42:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.11
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/sysusers.d/basic.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:43:02 dovecot_login authenticator failed for H=(LJ9ZTC3Rj7) [158.94.209.22]:55089: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:43:06 dovecot_login authenticator failed for H=(PGHGRHqDW) [2.58.56.77]:50562: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.249.252.237
country_id: 1861060
description:
2026-01-31 11:43:33 dovecot_login authenticator failed for H=fs96f9fced.tkyc203.ap.nuro.jp [150.249.252.237]:52643: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.100.159.2
country_id: 1835841
description:
2026-01-31 11:43:02 dovecot_login authenticator failed for H=([222.100.159.2]) [222.100.159.2]:51437: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.214
country_id: 6252001
description:
2026-01-31 11:43:25 dovecot_login authenticator failed for H=([208.69.161.214]) [208.69.161.214]:59183: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 11:43:38 dovecot_login authenticator failed for H=(bpqtrelvP) [178.16.54.22]:57867: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.42.67.114
country_id: 1814991
description:
2026-01-31 11:43:11 dovecot_login authenticator failed for H=([36.42.67.114]) [36.42.67.114]:39468: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:43:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:44:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 11:44:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:44:14 dovecot_login authenticator failed for H=(vfGu5rGwg) [158.94.209.22]:52617: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.132.164.25
country_id: 2635167
description:
2026-01-31 11:44:07 dovecot_login authenticator failed for H=(ADMIN) [23.132.164.25]:57128: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.9
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/sysusers.d/dbus.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.108.13
country_id: 1814991
description:
2026-01-31 11:44:34 dovecot_login authenticator failed for H=([119.6.108.13]) [119.6.108.13]:40155: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:44:16 dovecot_login authenticator failed for H=(nZwCc6) [2.58.56.77]:58595: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2026-01-31 11:45:00 dovecot_login authenticator failed for H=69-172-79-198.static.imsbiz.com (173-248-234-145.static.imsbiz.com) [69.172.79.198]:55366: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-31 11:45:13 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:46804: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 11:45:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:45:44 dovecot_login authenticator failed for H=(HKrfbsE) [158.94.209.22]:49272: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.19.12
country_id: 3144096
description:
2026-01-31 11:45:55 dovecot_login authenticator failed for H=(cm-84.211.19.12.get.no) [84.211.19.12]:46465: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-31 11:45:04 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:13378: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.112
country_id: 1814991
description:
2026-01-31 11:45:05 dovecot_login authenticator failed for H=([27.24.141.112]) [27.24.141.112]:39560: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:45:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:45:08 dovecot_login authenticator failed for H=(6TjsGM5sG) [158.94.209.22]:51914: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:45:25 dovecot_login authenticator failed for H=(gnGR24) [2.58.56.77]:63560: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
country_id: 337996
description:
2026-01-31 11:45:32 dovecot_login authenticator failed for H=([196.189.124.218]) [196.189.124.218]:36832: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.92.61.242
country_id: 1814991
description:
2026-01-31 11:46:11 dovecot_login authenticator failed for H=([222.92.61.242]) [222.92.61.242]:56026: 535 Incorrect authentication data (set_id=zainuddin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.175.210.161
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=448567 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:46:02 dovecot_login authenticator failed for H=(Byv63F) [158.94.209.22]:51185: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 11:46:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:46:08 dovecot_login authenticator failed for H=(w6VlxL2BJ) [2.58.56.77]:49399: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-31 11:46:36 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:35659: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: imax.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home2/imaxcom/public_html/assets||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:46:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.158
country_id: 1269750
description:
2026-01-31 11:46:02 dovecot_login authenticator failed for H=([182.95.26.52]) [182.95.185.158]:40066: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:47:14 dovecot_login authenticator failed for H=(pg9Ppsrbe) [2.58.56.77]:56754: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: box.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/woh/box.com.my/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:47:14 dovecot_login authenticator failed for H=(2QP0Qt) [158.94.209.22]:56035: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 11:47:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 11:48:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb@vc-b.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:48:20 dovecot_login authenticator failed for H=(bSAd2ds) [2.58.56.77]:59903: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.195
country_id: 1733045
description:
2026-01-31 11:48:47 dovecot_login authenticator failed for H=([49.124.159.195]) [49.124.159.195]:60972: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: box.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home2/woh/box.com.my/wp-content/uploads/admin.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2026-01-31 11:48:54 dovecot_login authenticator failed for H=([103.50.5.94]) [103.50.5.94]:56144: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:48:08 dovecot_login authenticator failed for H=(Yz6ytO) [158.94.209.22]:63942: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-31 11:49:25 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:42866: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:49:02 dovecot_login authenticator failed for H=(UW7Kpy) [158.94.209.22]:54174: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:49:08 dovecot_login authenticator failed for H=(UaNedwRGQ) [2.58.56.77]:61703: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/demos/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:49:36 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-01-31 11:49:50 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:52020: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:49:56 dovecot_login authenticator failed for H=(lzVury) [158.94.209.22]:54801: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-01-31 11:50:23 dovecot_login authenticator failed for H=(azteca-comunicaciones.com) [201.46.124.0]:1176: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:50:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:50:14 dovecot_login authenticator failed for H=(7UmBM8acR) [158.94.209.22]:62793: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:50:24 dovecot_login authenticator failed for H=(duceAIR) [2.58.56.77]:51589: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.2.140.230
country_id: 1814991
description:
2026-01-31 11:50:13 dovecot_login authenticator failed for H=([218.56.121.58]) [221.2.140.230]:59844: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:51:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:51:11 dovecot_login authenticator failed for H=(52AW9h4G) [2.58.56.77]:65290: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.107.16
country_id: 1269750
description:
2026-01-31 11:51:15 dovecot_login authenticator failed for H=(nsg-static-16.107.76.182-airtel.com) [182.76.107.16]:35648: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.171.146.247
country_id: 2921044
description:
[2026-01-31 11:51:07 +0800] info [cpaneld] 62.171.146.247 - agpc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agpc (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.187
country_id: 1269750
description:
2026-01-31 11:51:16 dovecot_login authenticator failed for H=(nsg-corporate-187.230.187.122.airtel.in) [122.187.230.187]:60045: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2026-01-31 11:51:49 dovecot_login authenticator failed for H=([152.52.236.122]) [152.52.236.122]:60114: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.0.228.11
country_id: 1269750
description:
2026-01-31 11:51:04 dovecot_login authenticator failed for H=([61.0.228.11]) [61.0.228.11]:38392: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2026-01-31 11:51:36 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:51292: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:51:08 dovecot_login authenticator failed for H=(rvaEwID0) [158.94.209.22]:56297: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.23.3.146
country_id: 1835841
description:
2026-01-31 11:52:04 dovecot_login authenticator failed for H=([59.23.3.146]) [59.23.3.146]:46930: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:52:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:52:24 dovecot_login authenticator failed for H=(XYZpQTE) [2.58.56.77]:58841: 535 Incorrect authentication data (set_id=norasikin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:52:02 dovecot_login authenticator failed for H=(R0sIHI) [158.94.209.22]:55400: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:53:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.253.233
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=208488 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:53:08 dovecot_login authenticator failed for H=(fSXd0DCUU) [2.58.56.77]:49274: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.244.111.66
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=28901516696291 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:53:14 dovecot_login authenticator failed for H=(VKEa5J) [158.94.209.22]:61305: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.142.113.50
country_id: 1733045
description:
[2026-01-31 11:53:33 +0800] info [webmaild] 175.142.113.50 - purchase2@evergrown.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:54:14 dovecot_login authenticator failed for H=(tMxJy3f) [2.58.56.77]:54946: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:54:26 dovecot_login authenticator failed for H=(VSQgFtZyVO) [158.94.209.22]:56777: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:54:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:54:08 dovecot_login authenticator failed for H=(KzZyMnT) [158.94.209.22]:56025: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.127.86
country_id: 1269750
description:
2026-01-31 11:55:52 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-097.178.23.125.airtelbroadband.in) [182.79.127.86]:41274: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.214.108.39
country_id: 3469034
description:
2026-01-31 11:55:30 dovecot_login authenticator failed for H=(b3d66c27.virtua.com.br) [179.214.108.39]:50162: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.218.49
country_id: 3469034
description:
2026-01-31 11:55:47 dovecot_login authenticator failed for H=(imparhoteis.static.gvt.net.br) [179.184.218.49]:49010: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-01-31 11:55:37 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:55188: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:55:04 dovecot_login authenticator failed for H=(gJSHBf) [2.58.56.77]:61109: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2026-01-31 11:55:07 dovecot_login authenticator failed for H=([218.149.235.152]) [218.149.235.152]:49826: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-01-31 11:55:48 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:48529: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:55:02 dovecot_login authenticator failed for H=(8qjJZh) [158.94.209.22]:50686: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.100.77
country_id: 1814991
description:
2026-01-31 11:55:57 dovecot_login authenticator failed for H=([111.26.100.77]) [111.26.100.77]:35034: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.145.163.164
country_id: 1814991
description:
2026-01-31 11:56:04 dovecot_login authenticator failed for H=([61.145.163.164]) [61.145.163.164]:50906: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:56:14 dovecot_login authenticator failed for H=(owb9DmhB) [158.94.209.22]:55985: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2026-01-31 11:56:18 dovecot_login authenticator failed for H=(customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:58958: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2026-01-31 11:56:31 dovecot_login authenticator failed for H=(nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:45858: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.84.209.146
country_id: 2017370
description:
2026-01-31 11:56:37 dovecot_login authenticator failed for H=([88.84.209.146]) [88.84.209.146]:58886: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-01-31 11:57:00 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:42086: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:56:20 dovecot_login authenticator failed for H=(0hYvZBDpp) [2.58.56.77]:52889: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-01-31 11:56:24 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:45414: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.4.153.7
country_id: 1814991
description:
2026-01-31 11:56:10 dovecot_login authenticator failed for H=([221.4.153.7]) [221.4.153.7]:48231: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.169.52.67
country_id: 2017370
description:
2026-01-31 11:56:46 dovecot_login authenticator failed for H=([193.169.52.67]) [193.169.52.67]:35584: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/m.me/img/photos/druma.php||SC:/home/indfinitydesign/public_html/m.me||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:57:08 dovecot_login authenticator failed for H=(Ude9U95yX) [158.94.209.22]:64574: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-01-31 11:57:11 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:55499: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:57:06 dovecot_login authenticator failed for H=(LRQlI8bk) [2.58.56.77]:58416: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2026-01-31 11:57:52 dovecot_login authenticator failed for H=(177-0-238-190.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:53494: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-31 11:57:53 dovecot_login authenticator failed for H=(www.safecleen.com) [58.49.113.138]:11357: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2026-01-31 11:57:39 dovecot_login authenticator failed for H=([183.182.99.92]) [183.182.99.92]:48604: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 11:57:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:57:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.2
country_id: 1269750
description:
2026-01-31 11:58:01 dovecot_login authenticator failed for H=([152.52.238.55]) [182.95.184.2]:59270: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 11:58:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:58:21 dovecot_login authenticator failed for H=(cWj75by) [158.94.209.22]:61258: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:58:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:58:03 dovecot_login authenticator failed for H=(DqbLgf8) [158.94.209.22]:56023: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:58:11 dovecot_login authenticator failed for H=(TCI1mGyl) [2.58.56.77]:62715: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2026-01-31 11:59:06 dovecot_login authenticator failed for H=([218.149.235.152]) [218.149.235.152]:51968: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 11:59:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 11:59:15 dovecot_login authenticator failed for H=(V9sHwEY) [158.94.209.22]:60506: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.53.19
country_id: 1643084
description:
2026-01-31 11:59:20 dovecot_login authenticator failed for H=([103.138.53.19]) [103.138.53.19]:34492: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2026-01-31 11:59:35 dovecot_login authenticator failed for H=([91.72.153.110]) [91.72.153.110]:53932: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-31 11:59:35 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:56378: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 11:59:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 11:59:20 dovecot_login authenticator failed for H=(9pUn6oE5fM) [2.58.56.77]:62807: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.118
country_id: 1814991
description:
2026-01-31 11:59:49 dovecot_login authenticator failed for H=([111.61.175.118]) [111.61.175.118]:11856: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.196.31.2
country_id: 1835841
description:
2026-01-31 11:59:55 dovecot_login authenticator failed for H=([121.128.76.110]) [211.196.31.2]:36409: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.235.8
country_id: 1327865
description:
2026-01-31 11:59:13 dovecot_login authenticator failed for H=([103.68.235.8]) [103.68.235.8]:53098: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.87.218.151
country_id: 1814991
description:
2026-01-31 12:00:55 dovecot_login authenticator failed for H=([39.87.218.151]) [39.87.218.151]:42504: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:00:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.84.96.98
country_id: 1269750
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/portfolios/sunway-dhill-residences/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 12:00:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 12:00:05 dovecot_login authenticator failed for H=(aD4JMKf5) [2.58.56.77]:59869: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:00:09 dovecot_login authenticator failed for H=(hQbwlwqZQ) [158.94.209.22]:51312: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
country_id: 1835841
description:
2026-01-31 12:00:44 dovecot_login authenticator failed for H=([61.72.59.106]) [61.72.59.106]:59709: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.4
country_id: 1835841
description:
2026-01-31 12:00:13 dovecot_login authenticator failed for H=([203.252.10.4]) [203.252.10.4]:37629: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.28.86.1
country_id: 1819730
description:
2026-01-31 12:00:41 dovecot_login authenticator failed for H=(113-28-86-1.static.imsbiz.com) [113.28.86.1]:60098: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.242
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/tmpfiles.d/x11.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:01:03 dovecot_login authenticator failed for H=(MnrDrHHr4) [158.94.209.22]:61180: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 12:01:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:01:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 12:01:15 dovecot_login authenticator failed for H=(n6i2PLC) [2.58.56.77]:60336: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.202
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/tmpfiles.d/provision.conf||User:root||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.137.92
country_id: 1835841
domain: usfood.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/usfoodcom/public_html/wp-admin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.2
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/tmpfiles.d/sudo.conf||User:root||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:02:33 dovecot_login authenticator failed for H=(SRPn41trHp) [158.94.209.22]:58546: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.98.68.199
country_id: 1835841
description:
2026-01-31 12:02:33 dovecot_login authenticator failed for H=([183.98.68.199]) [183.98.68.199]:50874: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.54.242.253
country_id: 2186224
description:
2026-01-31 12:02:40 dovecot_login authenticator failed for H=210-54-242-253.adsl.xtra.co.nz [210.54.242.253]:47790: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.92.240.254
country_id: 2921044
description:
2026-01-31 12:02:43 H=([91.92.240.254]) [91.92.240.254]:55614 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<sale@generaltradinglite.com> rejected RCPT <enquiry@symphony-led.com>: SPF: 91.92.240.254 is not allowed to send mail from generaltradinglite.com


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-31 12:02:48 H=([45.144.212.50]) [45.144.212.50]:64036 F=<ccmsservice@bangkokbank.com> rejected RCPT <mustapa@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from bangkokbank.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:02:15 dovecot_login authenticator failed for H=(Gr7I5Jc6) [158.94.209.22]:50754: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.141
country_id: 1819730
description:
2026-01-31 12:02:24 dovecot_login authenticator failed for H=([223.197.145.141]) [223.197.145.141]:51898: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-01-31 12:02:57 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:43994: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 12:02:03 dovecot_login authenticator failed for H=(WtF1SJSW) [2.58.56.77]:52234: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2026-01-31 12:02:20 dovecot_login authenticator failed for H=([128.185.12.179]) [128.185.12.179]:45396: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.60.211.114
country_id: 6252001
description:
2026-01-31 12:03:14 dovecot_login authenticator failed for H=67-60-211-114.cpe.sparklight.net [67.60.211.114]:52150: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:03:09 dovecot_login authenticator failed for H=(7zf23vQEs) [158.94.209.22]:57998: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 123.150.138.197
country_id: 1814991
description:
2026-01-31 12:03:54 31876 [Warning] Aborted connection 31876 to db: 'unconnected' user: 'unauthenticated' host: '123.150.138.197' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-01-31 12:03:44 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:49054: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 123.150.138.197
country_id: 1814991
description:
Jan 31 12:03:53 sv3 pure-ftpd[4086030]: (?@123.150.138.197) [INFO] New connection from 123.150.138.197


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 12:03:15 dovecot_login authenticator failed for H=(6bGdc5) [2.58.56.77]:55647: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.26
country_id: 1269750
description:
2026-01-31 12:03:31 dovecot_login authenticator failed for H=(nsg-corporate-247.223.187.122.airtel.in) [122.186.202.26]:36714: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.235.16
country_id: 102358
description:
2026-01-31 12:04:18 dovecot_login authenticator failed for H=(ADMIN) [95.181.235.16]:64189: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.74
country_id: 1269750
description:
2026-01-31 12:04:35 dovecot_login authenticator failed for H=([182.78.199.185]) [182.95.230.74]:55452: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.193.149
country_id: 1643084
description:
2026-01-31 12:04:58 dovecot_login authenticator failed for H=([103.186.193.149]) [103.186.193.149]:44250: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 12:04:02 dovecot_login authenticator failed for H=(Ob6N4U7) [2.58.56.77]:59505: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:04:03 dovecot_login authenticator failed for H=(TZgZPn) [158.94.209.22]:50168: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.66.147.8
country_id: 953987
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/data/continents/Asia.txt HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 185.220.100.254
country_id: 2921044
domain: www.chs.com.my
description:
IM360 WAF: Track spam in PrestaShop||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/HTWF/scripts/php/contact-form.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.97.59
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=97051516695307 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 12:05:59 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 12:05:12 dovecot_login authenticator failed for H=(zhVvrf) [2.58.56.77]:51338: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:05:15 dovecot_login authenticator failed for H=(5eFdUu) [158.94.209.22]:55694: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:05:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:06:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 12:06:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 12:06:24 dovecot_login authenticator failed for H=(QWHFsbB5) [2.58.56.77]:50047: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:06:45 dovecot_login authenticator failed for H=(L4eNt5lhm0) [158.94.209.22]:63825: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:06:09 dovecot_login authenticator failed for H=(001zrn) [158.94.209.22]:63183: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77218420
name: IM360 WAF: PHP Injection Attack: I/O Stream Found
abuser: 161.248.162.15
country_id: 1269750
domain: 42.0.28.25:80
description:
IM360 WAF: PHP Injection Attack: I/O Stream Found||MVN:MATCHED_VAR||MV:\xadd allow_url_include=1 \xadd auto_prepend_file=php://input||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140881
name: IM360 WAF: Infectors: Arbitrary code execution vulnerability in Request URI
abuser: 161.248.162.15
country_id: 1269750
domain: 42.0.28.25:80
description:
IM360 WAF: Infectors: Arbitrary code execution vulnerability in Request URI||RSV:7.71||T:APACHE||SC:/var/www/html/hello.world||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2026-01-31 12:07:57 dovecot_login authenticator failed for H=([182.95.51.166]) [182.95.51.166]:39098: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:07:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 123.150.138.197
country_id: 1814991
description:
Jan 31 12:07:04 sv3 pure-ftpd[4089106]: (?@123.150.138.197) [INFO] New connection from 123.150.138.197


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 12:07:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 161.248.162.15
country_id: 1269750
domain: 42.0.28.25:80
description:
IM360 WAF: PHP Injection Low value||MV:<?php shell_exec(base64_decode(\"KHdnZXQgLS1uby1jaGVjay1jZXJ0aWZpY2F0ZSAtcU8tIGh0dHBzOi8vMTc4LjE2LjU1LjIyNC9zaCB8fCBjdXJsIC1zayBodHRwczovLzE3OC4xNi41NS4yMjQvc2gpIHwgc2ggLXMgY3ZlXzIwMjRfNDU3Ny5zZWxmcmVw\")); echo(md5(\"Hello CVE-2024-4577\")); ?>||MVN:ARGS_NAMES:<?php shell_exec(base64_decode(\"KHdnZXQgLS1uby1jaGVjay1jZXJ0aWZpY2F0ZSAtcU8tIGh0dHBzOi8vMTc4LjE2LjU1LjIyNC9zaCB8fCBjdXJsIC1zayBodHRwczovLzE3OC4xNi41NS4yMjQvc2gpIHwgc2ggLXMgY3ZlXzIwMjRfNDU3Ny5zZWxmcmVw\")); echo(md5(\"Hello CVE-2024-4577\")); ?>||RSV:7.71||T:APACHE||SC:/var/www/html/hello.world||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:07:03 dovecot_login authenticator failed for H=(yRqoH2abdc) [158.94.209.22]:65014: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 12:07:10 dovecot_login authenticator failed for H=(mOadpSfFec) [2.58.56.77]:53533: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: modsec
rule: 77625153
name: IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)
abuser: 161.248.162.15
country_id: 1269750
domain: 42.0.28.25:80
description:
IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)||Action:||MV:\xadd allow_url_include=1 \xadd auto_prepend_file=php://input||MVN:MATCHED_VAR||WPU:||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 123.150.138.197
country_id: 1814991
description:
2026-01-31 12:07:04 31987 [Warning] Aborted connection 31987 to db: 'unconnected' user: 'unauthenticated' host: '123.150.138.197' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.84.209.188
country_id: 1814991
description:
2026-01-31 12:07:42 dovecot_login authenticator failed for H=([117.40.175.86]) [223.84.209.188]:34168: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2026-01-31 12:08:47 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:45406: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:08:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 12:08:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 12:08:18 dovecot_login authenticator failed for H=(p9SvbdiL) [2.58.56.77]:52030: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.235.41.149
country_id: 1562822
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/Backup/contact.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.182.87.38
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=457703 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: ds-staffing.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/dsstaffing/public_html/images||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 162.142.125.33
country_id: 6252001
description:
2026-01-31 12:08:09 32018 [Warning] Aborted connection 32018 to db: 'unconnected' user: 'unauthenticated' host: '162.142.125.33' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:08:16 dovecot_login authenticator failed for H=(4k5JpuX) [158.94.209.22]:58711: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:09:10 dovecot_login authenticator failed for H=(PvSFeRV) [158.94.209.22]:54796: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.251.197.46
country_id: 1814991
description:
2026-01-31 12:09:15 dovecot_login authenticator failed for H=([101.251.197.46]) [101.251.197.46]:47083: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-31 12:09:23 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:57372: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.84
country_id: 1733045
description:
2026-01-31 12:09:30 dovecot_login authenticator failed for H=([49.125.201.84]) [49.125.201.84]:55680: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-01-31 12:09:45 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:34572: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 12:09:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 12:09:06 dovecot_login authenticator failed for H=(AkudnYj) [2.58.56.77]:65027: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:09:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.199.172.66
country_id: 1814991
description:
2026-01-31 12:09:11 dovecot_login authenticator failed for H=([221.199.172.66]) [221.199.172.66]:34746: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.47.2
country_id: 1269750
description:
2026-01-31 12:09:46 dovecot_login authenticator failed for H=([27.123.105.140]) [182.95.47.2]:45784: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
country_id: 1835841
description:
2026-01-31 12:10:04 dovecot_login authenticator failed for H=([183.99.89.74]) [183.99.89.74]:33512: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 12:10:12 dovecot_login authenticator failed for H=(oyyZWt) [2.58.56.77]:61148: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-01-31 12:10:51 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:53928: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:10:04 dovecot_login authenticator failed for H=(ZhAE2iS39o) [158.94.209.22]:49760: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-31 12:10:16 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:55555: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
country_id: 1835841
description:
2026-01-31 12:10:18 dovecot_login authenticator failed for H=([211.223.41.90]) [211.223.41.90]:58382: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2026-01-31 12:10:38 dovecot_login authenticator failed for H=([169.211.232.182]) [169.211.232.182]:53866: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:10:58 dovecot_login authenticator failed for H=(HChH5J) [158.94.209.22]:51560: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 12:10:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:11:16 dovecot_login authenticator failed for H=(Y58Orp) [158.94.209.22]:59995: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.141.129
country_id: 1733045
description:
[2026-01-31 12:11:29 +0800] info [webmaild] 113.211.141.129 - s-osada@mckd.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 12:11:23 dovecot_login authenticator failed for H=(hOX13tC) [2.58.56.77]:60435: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.117
country_id: 1814991
description:
2026-01-31 12:11:36 dovecot_login authenticator failed for H=([111.61.175.117]) [111.61.175.117]:48992: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.19.200.63
country_id: 660013
description:
2026-01-31 12:12:09 dovecot_login authenticator failed for H=([146.19.200.63]) [146.19.200.63]:54488: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 12:12:10 dovecot_login authenticator failed for H=(z0h8aTep5b) [2.58.56.77]:57316: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:12:10 dovecot_login authenticator failed for H=(FHeS1KFO5h) [158.94.209.22]:57950: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.84.92.45
country_id: 1655842
description:
2026-01-31 12:12:06 dovecot_login authenticator failed for H=([115.84.92.45]) [115.84.92.45]:51494: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.157.98.80
country_id: 453733
description:
2026-01-31 12:12:17 dovecot_login authenticator failed for H=80-98-157-37.dyn.estpak.ee [37.157.98.80]:36774: 535 Incorrect authentication data (set_id=aziz)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 185.192.16.174
country_id: 2963597
domain: www.oxbold.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/adriv4.php||SC:/home/oxboldc/public_html/assets/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 12:13:21 dovecot_login authenticator failed for H=(qyp4uCn) [2.58.56.77]:52556: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.251.249.79
country_id: 2300660
description:
2026-01-31 12:13:44 dovecot_login authenticator failed for H=([197.251.249.79]) [197.251.249.79]:34374: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:13:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:13:04 dovecot_login authenticator failed for H=(GaIIiTPk2v) [158.94.209.22]:63857: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.50
country_id: 1668284
description:
2026-01-31 12:13:36 dovecot_login authenticator failed for H=111-70-32-50.emome-ip.hinet.net [111.70.32.50]:56507: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-01-31 12:14:40 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:42096: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 12:14:51 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-31 12:14:11 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:58202: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:14:16 dovecot_login authenticator failed for H=(5YgXKBOWv) [158.94.209.22]:63782: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2026-01-31 12:14:36 dovecot_login authenticator failed for H=syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:55774: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 12:14:08 dovecot_login authenticator failed for H=(vQpA7b) [2.58.56.77]:56562: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:14:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2026-01-31 12:14:05 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:46588: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 12:15:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account norasikin.vpb has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 35.216.144.195
country_id: 2658434
description:
Jan 31 12:15:20 sv3 pure-ftpd[4095652]: (?@35.216.144.195) [INFO] New connection from 35.216.144.195


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 12:15:18 dovecot_login authenticator failed for H=(K052wR) [2.58.56.77]:64303: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2026-01-31 12:15:20 dovecot_login authenticator failed for H=([196.188.187.205]) [196.188.187.205]:34204: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:15:28 dovecot_login authenticator failed for H=(VxPnA6G) [158.94.209.22]:60561: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:15:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:15:10 dovecot_login authenticator failed for H=(c4ksVw) [158.94.209.22]:60449: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
country_id: 1835841
description:
2026-01-31 12:15:12 dovecot_login authenticator failed for H=([220.95.14.102]) [220.95.14.102]:45688: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.216.144.195
country_id: 2658434
description:
Jan 31 12:15:16 sv3 pure-ftpd[4095559]: (?@35.216.144.195) [INFO] New connection from 35.216.144.195


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.82.236.69
country_id: 1814991
description:
2026-01-31 12:15:02 dovecot_login authenticator failed for H=([223.82.236.69]) [223.82.236.69]:1431: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-01-31 12:15:03 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:37940: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.211.32.242
country_id: 2328926
description:
2026-01-31 12:15:12 dovecot_login authenticator failed for H=([197.211.32.242]) [197.211.32.242]:55917: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.2
country_id: 1269750
description:
2026-01-31 12:16:35 dovecot_login authenticator failed for H=([152.52.238.55]) [182.95.184.2]:40272: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.255.50
country_id: 1269750
description:
2026-01-31 12:16:50 dovecot_login authenticator failed for H=([182.95.203.81]) [122.186.255.50]:48124: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 12:16:02 dovecot_login authenticator failed for H=(8BPWFQ8) [2.58.56.77]:60443: 535 Incorrect authentication data (set_id=norasikin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:16:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 139.162.70.53
country_id: 1861060
description:
2026-01-31 12:16:02 32271 [Warning] Aborted connection 32271 to db: 'unconnected' user: 'unauthenticated' host: '139.162.70.53' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:16:04 dovecot_login authenticator failed for H=(jZY9CzaeL) [158.94.209.22]:57675: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:17:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:17:16 dovecot_login authenticator failed for H=(zlprDRwx0) [158.94.209.22]:61058: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:18:11 dovecot_login authenticator failed for H=(AlRkDDK) [158.94.209.22]:65284: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-01-31 12:18:16 32393 [Warning] Aborted connection 32393 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:19:05 dovecot_login authenticator failed for H=(C71BQe) [158.94.209.22]:64178: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.6
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/local/apache/conf/php.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.247.248.154
country_id: 3469034
description:
2026-01-31 12:19:13 dovecot_login authenticator failed for H=([170.247.248.154]) [170.247.248.154]:52837: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-01-31 12:19:22 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:46892: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:19:23 dovecot_login authenticator failed for H=(H9luB7m) [158.94.209.22]:54245: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.17.91.226
country_id: 1562822
description:
2026-01-31 12:19:49 dovecot_login authenticator failed for H=([103.17.91.226]) [103.17.91.226]:58034: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.106
country_id: 1269750
description:
2026-01-31 12:20:26 dovecot_login authenticator failed for H=(nsg-corporate-121.229.185.122.airtel.in) [122.186.202.106]:47990: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-31 12:20:41 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:35904: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.159.71.249
country_id: 1835841
description:
2026-01-31 12:20:52 dovecot_login authenticator failed for H=([121.159.71.249]) [121.159.71.249]:40674: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.86.17.217
country_id: 6252001
description:
[2026-01-31 12:20:49 +0800] info [webmaild] 45.86.17.217 - intercessors@agpc.org.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:20:51 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.33.79
country_id: 1819730
description:
2026-01-31 12:20:05 dovecot_login authenticator failed for H=079.33.246.220.static.netvigator.com [220.246.33.79]:52675: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:20:17 dovecot_login authenticator failed for H=(mWxCmH) [158.94.209.22]:54365: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-31 12:21:52 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:41784: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.170.15
country_id: 3175395
description:
2026-01-31 12:21:29 dovecot_plain authenticator failed for H=([100.64.100.6]) [2.57.170.15]:56386: 535 Incorrect authentication data (set_id=rnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:21:11 dovecot_login authenticator failed for H=(DXnxuoBG) [158.94.209.22]:59716: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.98.68.199
country_id: 1835841
description:
2026-01-31 12:21:25 dovecot_login authenticator failed for H=([183.98.68.199]) [183.98.68.199]:38730: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:21:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:22:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.193.127
country_id: 1814991
description:
2026-01-31 12:22:38 dovecot_login authenticator failed for H=([183.167.193.127]) [183.167.193.127]:36766: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: modsec
rule: 77142097
name: IM360 WAF: Track spam via contactform for WordPress
abuser: 37.19.223.107
country_id: 2782113
domain: pftfood.com
description:
IM360 WAF: Track spam via contactform for WordPress||RSV:7.71||T:APACHE||MVN:REQUEST_URI||MV:/wp-json/contact-form-7/v1/contact-forms/454/feedback||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:22:05 dovecot_login authenticator failed for H=(C3bFdW5) [158.94.209.22]:59159: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-01-31 12:22:28 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:53278: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.188
country_id: 1814991
description:
2026-01-31 12:23:00 dovecot_login authenticator failed for H=([111.61.177.188]) [111.61.177.188]:21620: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-01-31 12:22:13 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:54314: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 37.19.223.107
country_id: 2782113
domain: pftfood.com
description:
IM360 WAF: Track spam in PrestaShop||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-json/contact-form-7/v1/contact-forms/454/feedback||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-01-31 12:23:48 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:35381: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-01-31 12:23:52 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:41068: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.39.82
country_id: 1814991
description:
2026-01-31 12:23:07 dovecot_login authenticator failed for H=([60.174.39.82]) [60.174.39.82]:51632: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:23:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.60.211.114
country_id: 6252001
description:
2026-01-31 12:23:25 dovecot_login authenticator failed for H=67-60-211-114.cpe.sparklight.net [67.60.211.114]:40961: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-31 12:23:15 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:56948: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2026-01-31 12:23:21 dovecot_login authenticator failed for H=95-87-248-223.ip.btc-net.bg [95.87.248.223]:57214: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:23:35 dovecot_login authenticator failed for H=(HhA7Ta) [158.94.209.22]:56213: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.74.106.169
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/swiftmailer/swiftmailer/doc/plugins.rst HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:23:17 dovecot_login authenticator failed for H=(UDlkGbIJvm) [158.94.209.22]:49414: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:24:11 dovecot_login authenticator failed for H=(fN7kEkmp7y) [158.94.209.22]:64114: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.107.1
country_id: 1269750
description:
2026-01-31 12:24:12 dovecot_login authenticator failed for H=([144.24.107.1]) [144.24.107.1]:33804: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.171.226
country_id: 2017370
description:
2026-01-31 12:24:03 dovecot_login authenticator failed for H=([83.239.171.226]) [83.239.171.226]:41470: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:24:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.110.237
country_id: 3144096
description:
2026-01-31 12:24:55 dovecot_login authenticator failed for H=(cm-46.212.110.237.get.no) [46.212.110.237]:43292: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.178.165.251
country_id: 1835841
description:
2026-01-31 12:24:45 dovecot_login authenticator failed for H=([211.178.165.251]) [211.178.165.251]:37744: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-01-31 12:24:23 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:48666: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: tst-ma.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home/tstmacom/public_html/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:25:05 dovecot_login authenticator failed for H=(aQlSc0R11) [158.94.209.22]:60034: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:25:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:26:17 dovecot_login authenticator failed for H=(tscpJimCiL) [158.94.209.22]:51626: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.220.30
country_id: 1269750
description:
2026-01-31 12:26:43 dovecot_login authenticator failed for H=([125.19.220.30]) [125.19.220.30]:50522: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-01-31 12:26:31 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:59536: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2026-01-31 12:26:42 dovecot_login authenticator failed for H=24-119-144-86.cpe.sparklight.net [24.119.144.86]:57974: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.15.246.138
country_id: 2635167
description:
[2026-01-31 12:26:59 +0800] info [webmaild] 45.15.246.138 - prayerlink@agpc.org.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.98.212.74
country_id: 1835841
description:
2026-01-31 12:26:30 dovecot_login authenticator failed for H=([183.98.212.74]) [183.98.212.74]:34011: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.185.130.103
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=3&sub=40 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.49.14
country_id: 1814991
description:
2026-01-31 12:27:21 dovecot_login authenticator failed for H=([121.18.49.14]) [121.18.49.14]:56726: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:27:47 dovecot_login authenticator failed for H=(k5sNXIkme1) [158.94.209.22]:58231: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2026-01-31 12:27:53 dovecot_login authenticator failed for H=42-200-70-134.static.imsbiz.com [42.200.70.134]:34543: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:27:11 dovecot_login authenticator failed for H=(tur7ZdYan8) [158.94.209.22]:56687: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.146
country_id: 1819730
description:
2026-01-31 12:27:38 dovecot_login authenticator failed for H=(223-197-145-146.static.imsbiz.com) [223.197.145.146]:49401: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-31 12:27:50 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:51663: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.241.64.237
country_id: 1835841
description:
2026-01-31 12:28:28 dovecot_login authenticator failed for H=([1.241.64.237]) [1.241.64.237]:44072: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.52.79
country_id: 6251999
description:
2026-01-31 12:28:50 dovecot_login authenticator failed for H=(ADMIN) [212.56.52.79]:14175: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.237.177.239
country_id: 1562822
description:
2026-01-31 12:28:20 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [171.237.177.239]:8047: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
country_id: 1861060
description:
2026-01-31 12:28:01 dovecot_login authenticator failed for H=7.248.146.34.bc.googleusercontent.com [34.146.248.7]:37298: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-01-31 12:28:36 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:60292: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.239.150.15
country_id: 3996063
description:
2026-01-31 12:28:44 dovecot_login authenticator failed for H=(170-239-150-15.internet.ientc.net.mx) [170.239.150.15]:40568: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2026-01-31 12:28:53 dovecot_login authenticator failed for H=([103.50.5.94]) [103.50.5.94]:38483: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.5
country_id: 1814991
description:
2026-01-31 12:28:26 dovecot_login authenticator failed for H=([111.61.97.5]) [111.61.97.5]:47996: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:28:39 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:28:05 dovecot_login authenticator failed for H=(p8T8UyQg) [158.94.209.22]:54378: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.22.116.94
country_id: 1269750
description:
2026-01-31 12:29:50 dovecot_login authenticator failed for H=([152.52.234.222]) [125.22.116.94]:60234: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-31 12:29:35 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:26536: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
country_id: 1835841
description:
2026-01-31 12:29:02 dovecot_login authenticator failed for H=([118.36.234.156]) [118.36.234.156]:55888: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:29:17 dovecot_login authenticator failed for H=(Hdc1VMg) [158.94.209.22]:61087: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.150.100.174
country_id: 2635167
description:
2026-01-31 12:29:35 dovecot_login authenticator failed for H=host86-150-100-174.range86-150.btcentralplus.com [86.150.100.174]:51311: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-01-31 12:29:44 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:45274: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:29:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.138.203
country_id: 6252001
description:
Jan 31 12:30:49 sv3 pure-ftpd[4108325]: (?@167.94.138.203) [INFO] New connection from 167.94.138.203


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.208.142.26
country_id: 1835841
description:
2026-01-31 12:30:59 dovecot_login authenticator failed for H=([175.208.142.26]) [175.208.142.26]:53090: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-01-31 12:30:03 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:21524: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.108.13
country_id: 1814991
description:
2026-01-31 12:30:02 dovecot_login authenticator failed for H=([119.6.108.13]) [119.6.108.13]:37695: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.187
country_id: 1269750
description:
2026-01-31 12:30:03 dovecot_login authenticator failed for H=(nsg-corporate-187.230.187.122.airtel.in) [122.187.230.187]:45928: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:30:11 dovecot_login authenticator failed for H=(zmPSOvkpe5) [158.94.209.22]:59103: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-01-31 12:30:17 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:51896: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 12:30:51 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:56158: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-01-31 12:30:39 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:33108: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:30:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.5
country_id: 1814991
description:
2026-01-31 12:30:11 dovecot_login authenticator failed for H=([111.61.97.5]) [111.61.97.5]:31918: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-01-31 12:30:16 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:38674: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.203.132.68
country_id: 2658434
domain: u-net.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home/unetcom/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.241.77.78
country_id: 1269750
description:
2026-01-31 12:30:30 dovecot_login authenticator failed for H=([117.241.77.78]) [117.241.77.78]:57712: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.209.102
country_id: 2017370
description:
2026-01-31 12:30:43 dovecot_login authenticator failed for H=95-31-209-102.broadband.corbina.ru [95.31.209.102]:34780: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:31:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:31:05 dovecot_login authenticator failed for H=(aU24kGdP) [158.94.209.22]:53319: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.179.158
country_id: 2017370
description:
2026-01-31 12:31:18 dovecot_login authenticator failed for H=broadband-77-37-179-158.ip.moscow.rt.ru [77.37.179.158]:58848: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.61.36.22
country_id: 1835841
description:
2026-01-31 12:31:23 dovecot_login authenticator failed for H=([125.61.36.25]) [125.61.36.22]:58928: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.145.38
country_id: 1835841
description:
2026-01-31 12:31:30 dovecot_login authenticator failed for H=([61.72.145.38]) [61.72.145.38]:35661: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.102.155.10
country_id: 6252001
description:
[2026-01-31 12:31:35 +0800] info [webmaild] 191.102.155.10 - central@agpc.org.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:31:59 dovecot_login authenticator failed for H=(0bhAgnv) [158.94.209.22]:63018: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.32.213.178
country_id: 1819730
description:
2026-01-31 12:32:14 dovecot_plain authenticator failed for H=(nvzgfg2drdcak0liyv8h10kzsr) [152.32.213.178]:47994: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:32:17 dovecot_login authenticator failed for H=(DimNXWes) [158.94.209.22]:62747: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:32:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2026-01-31 12:32:54 dovecot_login authenticator failed for H=(49.206.201.253.actcorp.in) [49.206.201.253]:46388: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.2.172
country_id: 2017370
description:
2026-01-31 12:33:06 dovecot_login authenticator failed for H=([31.173.2.172]) [31.173.2.172]:47674: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:33:11 dovecot_login authenticator failed for H=(iaBoGFAbuC) [158.94.209.22]:59452: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.133.31
country_id: 1733045
description:
[2026-01-31 12:33:25 +0800] info [webmaild] 113.211.133.31 - felicia@nexuscollection.com "POST /cpsess9559608849/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [113.211.121.206] != Current IP Address [113.211.133.31]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.144.50.202
country_id: 1814991
description:
2026-01-31 12:33:07 dovecot_login authenticator failed for H=([219.144.50.202]) [219.144.50.202]:41572: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:33:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2026-01-31 12:33:23 dovecot_login authenticator failed for H=([128.185.253.122]) [128.185.253.122]:48204: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:34:05 dovecot_login authenticator failed for H=(lkrY3dI) [158.94.209.22]:59849: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.58
country_id: 1733045
description:
2026-01-31 12:35:44 dovecot_login authenticator failed for H=([49.124.153.58]) [49.124.153.58]:59026: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2026-01-31 12:35:11 dovecot_login authenticator failed for H=(1522312565.colombiatel.co) [152.231.25.64]:59315: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:35:17 dovecot_login authenticator failed for H=(hqnWDQ4bTy) [158.94.209.22]:57460: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.198.31
country_id: 1814991
description:
2026-01-31 12:35:22 dovecot_login authenticator failed for H=([183.167.198.31]) [183.167.198.31]:42245: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.214.108.39
country_id: 3469034
description:
2026-01-31 12:35:34 dovecot_login authenticator failed for H=(b3d66c27.virtua.com.br) [179.214.108.39]:36384: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:36:11 dovecot_login authenticator failed for H=(vKfDgFr) [158.94.209.22]:56569: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:36:27 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:36:29 dovecot_login authenticator failed for H=(WV4VT9g) [158.94.209.22]:65181: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.7.164.163
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/church/112/27381 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-01-31 12:37:53 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:38028: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:37:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-01-31 12:37:53 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:47462: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:37:05 dovecot_login authenticator failed for H=(jLP1JW8i) [158.94.209.22]:49492: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.250.182.141
country_id: 1814991
description:
2026-01-31 12:37:06 dovecot_login authenticator failed for H=([118.250.182.141]) [118.250.182.141]:38282: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.50
country_id: 1269750
description:
2026-01-31 12:37:24 dovecot_login authenticator failed for H=(aes-static-225.77.144.59.airtel.in) [182.95.123.50]:44010: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 52.231.68.175
country_id: 1835841
domain: maalloys.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/maalloyscom/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.60.226.55
country_id: 3017382
description:
[2026-01-31 12:38:53 +0800] info [cpaneld] 37.60.226.55 - oxboldc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:38:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:38:17 dovecot_login authenticator failed for H=(YboNq6z) [158.94.209.22]:57563: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.105.206
country_id: 1814991
description:
2026-01-31 12:38:17 dovecot_login authenticator failed for H=([60.173.105.206]) [60.173.105.206]:59298: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.126
country_id: 1819730
description:
2026-01-31 12:38:35 dovecot_login authenticator failed for H=(223-197-145-126.static.imsbiz.com) [223.197.145.126]:62417: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.6.25.118
country_id: 1835841
description:
2026-01-31 12:39:06 dovecot_plain authenticator failed for H=(evr1fu3p80iea0xdwf8eljmcodzxkk) [59.6.25.118]:41430: 535 Incorrect authentication data (set_id=2096jasonkua@printspecsolution.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:39:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:39:11 dovecot_login authenticator failed for H=(vobUJSTzQ) [158.94.209.22]:50874: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: kendek.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/kendek/public_html/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/component/tag/images/img/druma_photos/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:40:05 dovecot_login authenticator failed for H=(hYqQV5) [158.94.209.22]:50968: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:40:23 dovecot_login authenticator failed for H=(TAfbUUG0Wx) [158.94.209.22]:65111: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77350600
name: IM360 WAF: Suspicious .min.php file in wp-includes
abuser: 52.231.68.175
country_id: 1835841
domain: maalloys.com.my
description:
IM360 WAF: Suspicious .min.php file in wp-includes||SC:/home2/maalloyscom/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:40:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.180.201.104
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=825907 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.231.68.175
country_id: 1835841
domain: maalloys.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/maalloyscom/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:41:17 dovecot_login authenticator failed for H=(F2NALf) [158.94.209.22]:53600: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
country_id: 1814991
description:
2026-01-31 12:41:54 dovecot_login authenticator failed for H=([111.61.177.190]) [111.61.177.190]:45582: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2026-01-31 12:42:00 dovecot_login authenticator failed for H=([128.185.201.138]) [128.185.201.138]:51642: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.231.68.175
country_id: 1835841
domain: maalloys.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home2/maalloyscom/public_html/assets||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2026-01-31 12:42:23 dovecot_login authenticator failed for H=(201-15-149-254.pltce300.ipd.brasiltelecom.net.br) [201.15.149.254]:35317: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.16.112.160
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=48721514875141 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2026-01-31 12:42:47 dovecot_login authenticator failed for H=([220.93.167.144]) [220.93.167.144]:48568: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:42:11 dovecot_login authenticator failed for H=(YiNrxev) [158.94.209.22]:53025: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.138
country_id: 1819730
description:
2026-01-31 12:42:16 dovecot_login authenticator failed for H=(223-197-153-138.static.imsbiz.com) [223.197.153.138]:65480: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-01-31 12:42:32 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.227.214.33
country_id: 1835841
description:
2026-01-31 12:42:39 dovecot_login authenticator failed for H=([182.227.214.33]) [182.227.214.33]:55920: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-01-31 12:42:08 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:50283: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-01-31 12:42:35 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:51318: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.85
country_id: 337996
description:
2026-01-31 12:42:28 dovecot_login authenticator failed for H=([196.188.187.85]) [196.188.187.85]:41712: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:43:05 dovecot_login authenticator failed for H=(YhnUlF) [158.94.209.22]:64768: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:44:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:44:17 dovecot_login authenticator failed for H=(YEOrY9UQ6E) [158.94.209.22]:51218: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:44:35 dovecot_login authenticator failed for H=(2nPMRi0ztm) [158.94.209.22]:59324: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.231.68.175
country_id: 1835841
domain: maalloys.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2024/index.php||SC:/home2/maalloyscom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2026-01-31 12:45:42 dovecot_plain authenticator failed for H=(epimang) [91.73.188.251]:53842: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.52.114
country_id: 1269750
description:
2026-01-31 12:45:56 dovecot_login authenticator failed for H=(nsg-corporate-255.223.187.122.airtel.in) [182.79.52.114]:40610: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:45:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:45:11 dovecot_login authenticator failed for H=(JAv53rqwi) [158.94.209.22]:59877: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:46:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:46:05 dovecot_login authenticator failed for H=(bZ9YKrLOri) [158.94.209.22]:50992: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:47:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:47:17 dovecot_login authenticator failed for H=(ffdJNTlN) [158.94.209.22]:63777: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:48:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:48:11 dovecot_login authenticator failed for H=(4fuukXZFX) [158.94.209.22]:53923: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.60.211.114
country_id: 6252001
description:
2026-01-31 12:48:40 dovecot_login authenticator failed for H=67-60-211-114.cpe.sparklight.net [67.60.211.114]:50287: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:48:47 dovecot_login authenticator failed for H=(uSru1pLHXi) [158.94.209.22]:51535: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2026-01-31 12:48:48 dovecot_login authenticator failed for H=([121.179.93.147]) [121.179.93.147]:40080: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
country_id: 1819730
description:
2026-01-31 12:48:52 dovecot_login authenticator failed for H=227.42.246.220.static.netvigator.com [220.246.42.227]:54851: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:49:05 dovecot_login authenticator failed for H=(1I4OONF) [158.94.209.22]:57607: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2026-01-31 12:49:20 dovecot_login authenticator failed for H=([121.179.93.147]) [121.179.93.147]:33426: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-31 12:49:24 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:42612: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-01-31 12:49:02 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:37180: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-01-31 12:49:35 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:39300: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.228.24.141
country_id: 6252001
description:
2026-01-31 12:49:14 dovecot_plain authenticator failed for H=([10.12.18.128]) [140.228.24.141]:37767: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2026-01-31 12:50:56 dovecot_login authenticator failed for H=(nsg-corporate-54.222.187.122.airtel.in) [122.187.222.54]:34694: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:50:17 dovecot_login authenticator failed for H=(aDeO5FS) [158.94.209.22]:63154: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.130
country_id: 1269750
description:
2026-01-31 12:50:27 dovecot_login authenticator failed for H=(nsg-corporate-130.230.187.122.airtel.in) [122.187.230.130]:50051: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.250.50
country_id: 1814991
description:
2026-01-31 12:50:56 dovecot_login authenticator failed for H=(50.250.223.60.adsl-pool.sx.cn) [60.223.250.50]:37821: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:51:11 dovecot_login authenticator failed for H=(bXEUaJw) [158.94.209.22]:62098: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.193.127
country_id: 1814991
description:
2026-01-31 12:52:14 dovecot_login authenticator failed for H=([183.167.193.127]) [183.167.193.127]:47911: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.222.72.182
country_id: 1814991
description:
2026-01-31 12:52:42 dovecot_login authenticator failed for H=([58.222.72.182]) [58.222.72.182]:40588: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:52:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
country_id: 1269750
description:
2026-01-31 12:52:03 dovecot_login authenticator failed for H=([103.55.89.5]) [116.75.218.103]:37576: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:52:05 dovecot_login authenticator failed for H=(xp5Oqgz3EF) [158.94.209.22]:61588: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.204.109
country_id: 3469034
description:
2026-01-31 12:52:51 dovecot_login authenticator failed for H=(igrejadorecreio.static.host.gvt.net.br) [186.215.204.109]:34200: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.242
country_id: 1814991
description:
2026-01-31 12:52:56 dovecot_login authenticator failed for H=([111.61.176.242]) [111.61.176.242]:25926: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:52:59 dovecot_login authenticator failed for H=(azVfc2D) [158.94.209.22]:60474: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-31 12:52:14 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:37734: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 12:52:20 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:42482: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-31 12:52:40 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:37958: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.116.131.13
country_id: 1814991
description:
2026-01-31 12:53:25 dovecot_login authenticator failed for H=([123.116.131.13]) [123.116.131.13]:56661: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:53:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-01-31 12:53:27 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:35800: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.222
country_id: 1269750
description:
2026-01-31 12:53:44 dovecot_login authenticator failed for H=(nsg-corporate-222.230.187.122.airtel.in) [122.187.230.222]:48614: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.198.180.129
country_id: 1835841
description:
2026-01-31 12:53:15 dovecot_login authenticator failed for H=([175.198.180.129]) [175.198.180.129]:50878: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:53:17 dovecot_login authenticator failed for H=(hkJX4gh) [158.94.209.22]:65356: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/img/img/news.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.133.172.231
country_id: 2635167
description:
2026-01-31 12:54:45 dovecot_login authenticator failed for H=(ADMIN) [45.133.172.231]:27864: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:54:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:54:11 dovecot_login authenticator failed for H=(FvqhZfgyrH) [158.94.209.22]:63544: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.154.34.130
country_id: 298795
description:
2026-01-31 12:55:00 dovecot_login authenticator failed for H=(server.keyubu.com) [94.154.34.130]:58046: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-01-31 12:55:08 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [116.98.104.138]:49882: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.157.25
country_id: 2921044
description:
2026-01-31 12:55:22 dovecot_plain authenticator failed for H=([10.239.0.17]) [191.101.157.25]:34581: 535 Incorrect authentication data (set_id=sylviagooi@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:55:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:55:05 dovecot_login authenticator failed for H=(A0PdeWG) [158.94.209.22]:61324: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:56:17 dovecot_login authenticator failed for H=(QoMrFCR) [158.94.209.22]:61767: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.254.218.115
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=61961516695189 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:56:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.128.162.146
country_id: 1814991
description:
2026-01-31 12:56:14 dovecot_login authenticator failed for H=([27.128.162.146]) [27.128.162.146]:41758: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.22.48.19
country_id: 2017370
description:
2026-01-31 12:56:25 dovecot_login authenticator failed for H=(zimbra.pragma.ru) [81.22.48.19]:52195: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-01-31 12:56:44 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:53284: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.157.25
country_id: 2921044
description:
2026-01-31 12:56:12 dovecot_plain authenticator failed for H=([10.239.0.17]) [191.101.157.25]:33980: 535 Incorrect authentication data (set_id=sylviagooi@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:57:29 dovecot_login authenticator failed for H=(RUD23ArqMK) [158.94.209.22]:59693: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.154.34.130
country_id: 298795
description:
2026-01-31 12:57:59 dovecot_login authenticator failed for H=(server.keyubu.com) [94.154.34.130]:39132: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:57:11 dovecot_login authenticator failed for H=(h33C84WDPd) [158.94.209.22]:56402: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.231.41.231
country_id: 1562822
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/customers.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.246.238
country_id: 1814991
description:
2026-01-31 12:58:44 dovecot_login authenticator failed for H=([218.21.246.238]) [218.21.246.238]:35638: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:58:05 dovecot_login authenticator failed for H=(SYsWA3sRX) [158.94.209.22]:49903: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.86.4
country_id: 1814991
description:
2026-01-31 12:58:09 dovecot_login authenticator failed for H=([60.174.86.4]) [60.174.86.4]:40294: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.250.50
country_id: 1814991
description:
2026-01-31 12:58:15 dovecot_login authenticator failed for H=(50.250.223.60.adsl-pool.sx.cn) [60.223.250.50]:50104: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.196.9.141
country_id: 2635167
description:
2026-01-31 12:59:41 dovecot_login authenticator failed for H=(ADMIN) [185.196.9.141]:33820: 535 Incorrect authentication data (set_id=admin@jpack.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 12:59:51 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-01-31 12:59:17 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:44196: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.104.166.110
country_id: 1835841
description:
2026-01-31 12:59:27 dovecot_login authenticator failed for H=([211.104.166.110]) [211.104.166.110]:36205: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.66.231
country_id: 3469034
description:
2026-01-31 12:59:11 dovecot_login authenticator failed for H=(187.58.64.145.static.host.gvt.net.br) [187.58.66.231]:42234: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 12:59:17 dovecot_login authenticator failed for H=(ldrft2IIN) [158.94.209.22]:63832: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.10.20
country_id: 1814991
description:
2026-01-31 13:00:10 dovecot_login authenticator failed for H=([221.10.10.20]) [221.10.10.20]:59481: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-01-31 13:00:35 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:53200: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:00:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:00:11 dovecot_login authenticator failed for H=(5JnDKQ412n) [158.94.209.22]:57616: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:01:05 dovecot_login authenticator failed for H=(MKzlwfxuZ) [158.94.209.22]:51373: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:01:23 dovecot_login authenticator failed for H=(lSH4g55) [158.94.209.22]:54847: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.146.24.164
country_id: 2017370
description:
2026-01-31 13:01:44 dovecot_login authenticator failed for H=([91.146.24.164]) [91.146.24.164]:55198: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2026-01-31 13:01:46 dovecot_login authenticator failed for H=([169.211.232.182]) [169.211.232.182]:44702: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:01:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.131
country_id: 2017370
description:
2026-01-31 13:01:35 dovecot_login authenticator failed for H=([178.178.194.131]) [178.178.194.131]:37524: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-31 13:01:57 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:46469: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.249.252.237
country_id: 1861060
description:
2026-01-31 13:02:39 dovecot_login authenticator failed for H=fs96f9fced.tkyc203.ap.nuro.jp [150.249.252.237]:60170: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:02:17 dovecot_login authenticator failed for H=(NdXl7buH) [158.94.209.22]:64861: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:02:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.234.212.101
country_id: 2017370
description:
2026-01-31 13:02:30 dovecot_login authenticator failed for H=(net212.234.188-101.ertelecom.ru) [188.234.212.101]:51544: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.199.172.66
country_id: 1814991
description:
2026-01-31 13:03:17 dovecot_login authenticator failed for H=([221.199.172.66]) [221.199.172.66]:51346: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:03:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.204.124.32
country_id: 1269750
description:
2026-01-31 13:03:16 dovecot_login authenticator failed for H=(broadband.actcorp.in) [49.204.124.32]:54036: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.230.184
country_id: 1814991
description:
2026-01-31 13:03:47 dovecot_login authenticator failed for H=([60.172.230.184]) [60.172.230.184]:39119: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.34
country_id: 1269750
description:
2026-01-31 13:03:50 dovecot_login authenticator failed for H=(nsg-corporate-78.223.187.122.airtel.in) [182.66.214.34]:32814: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.211.205.14
country_id: 1269750
description:
2026-01-31 13:03:51 dovecot_login authenticator failed for H=([103.211.205.14]) [103.211.205.14]:41530: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:03:11 dovecot_login authenticator failed for H=(7a7qrX) [158.94.209.22]:58233: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.180.28.66
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/index.php/uk/hotel.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:04:05 dovecot_login authenticator failed for H=(mt8r8y) [158.94.209.22]:51691: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
country_id: 1814991
description:
2026-01-31 13:04:05 dovecot_login authenticator failed for H=([182.42.113.10]) [182.42.113.10]:54347: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.181.8.135
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=993425 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:04:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:05:17 dovecot_login authenticator failed for H=(Tyw5lbWM) [158.94.209.22]:64858: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.160.29.241
country_id: 1835841
description:
2026-01-31 13:06:01 dovecot_login authenticator failed for H=([112.160.29.241]) [112.160.29.241]:48732: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-31 13:05:25 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:37616: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:05:35 dovecot_login authenticator failed for H=(JIbttT91Ba) [158.94.209.22]:51707: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
country_id: 1835841
description:
2026-01-31 13:05:57 dovecot_login authenticator failed for H=([220.95.14.102]) [220.95.14.102]:54782: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-31 13:06:15 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:49730: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.114
country_id: 1835841
description:
2026-01-31 13:06:18 dovecot_login authenticator failed for H=([1.250.67.114]) [1.250.67.114]:40148: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.168
country_id: 1269750
description:
2026-01-31 13:06:29 dovecot_login authenticator failed for H=(nsg-corporate-168.229.187.122.airtel.in) [122.187.229.168]:58798: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.246.89.68
country_id: 1835841
description:
2026-01-31 13:06:03 dovecot_login authenticator failed for H=([106.246.89.68]) [106.246.89.68]:44022: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:06:11 dovecot_login authenticator failed for H=(nlVXNiJOv) [158.94.209.22]:58142: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 103.118.150.170
country_id: 1269750
description:
2026-01-31 13:06:48 34195 [Warning] Aborted connection 34195 to db: 'unconnected' user: 'unauthenticated' host: '103.118.150.170' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:07:23 dovecot_login authenticator failed for H=(toBdYRt) [158.94.208.175]:60143: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:07:39 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:07:05 dovecot_login authenticator failed for H=(CHqfOQWWe) [158.94.209.22]:51347: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-01-31 13:07:28 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:39038: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.23.209.47
country_id: 3865483
description:
2026-01-31 13:07:59 dovecot_login authenticator failed for H=(cpe-186-23-209-47.telecentro-reversos.com.ar) [186.23.209.47]:48253: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:08:09 dovecot_login authenticator failed for H=(u2QWcAXGh) [158.94.208.175]:57432: 535 Incorrect authentication data (set_id=euratech)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.167.244.178
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php?page_id=45 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:08:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:08:17 dovecot_login authenticator failed for H=(QNhavhA7) [158.94.209.22]:63954: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:09:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/fkrcom/public_html/images/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/img/photos/project.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-31 13:09:57 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:37874: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:09:11 dovecot_login authenticator failed for H=(XmZBpV) [158.94.209.22]:56566: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:09:47 dovecot_login authenticator failed for H=(KlqkPYQxee) [158.94.209.22]:62543: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:10:33 dovecot_login authenticator failed for H=(ArMT7Isncv) [158.94.208.175]:57441: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:10:05 dovecot_login authenticator failed for H=(IE3czm) [158.94.209.22]:49269: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.58.242
country_id: 1835841
description:
2026-01-31 13:10:19 dovecot_login authenticator failed for H=([61.72.58.242]) [61.72.58.242]:40813: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.84.238.90
country_id: 2017370
description:
2026-01-31 13:10:27 dovecot_login authenticator failed for H=broadband-95-84-238-90.ip.moscow.rt.ru [95.84.238.90]:60612: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:10:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-31 13:10:25 H=([45.144.212.50]) [45.144.212.50]:53709 F=<ccmsservice@bangkokbank.com> rejected RCPT <astbtu@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from bangkokbank.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.148.10
country_id: 1814991
description:
2026-01-31 13:11:53 dovecot_login authenticator failed for H=(hebei.18.121.in-addr.arpa) [121.18.148.10]:36314: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:11:17 dovecot_login authenticator failed for H=(uDPMfI) [158.94.209.22]:61568: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2026-01-31 13:11:34 dovecot_login authenticator failed for H=([218.149.235.152]) [218.149.235.152]:39920: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:11:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:12:11 dovecot_login authenticator failed for H=(BA2dOK1) [158.94.209.22]:54150: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:12:28 dovecot_login authenticator failed for H=(4Zj9CuLE4) [158.94.208.175]:57957: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
country_id: 2017370
description:
2026-01-31 13:12:42 dovecot_plain authenticator failed for H=(rophi) [95.79.108.51]:43147: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:12:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2026-01-31 13:13:50 dovecot_login authenticator failed for H=net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:49689: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:13:59 dovecot_login authenticator failed for H=(I5CHibQGW3) [158.94.209.22]:55684: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:13:05 dovecot_login authenticator failed for H=(KzhD0pV1e) [158.94.209.22]:63177: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2026-01-31 13:13:26 dovecot_login authenticator failed for H=([5.32.22.218]) [5.32.22.218]:52289: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:13:34 dovecot_login authenticator failed for H=(b8GaHvRuc) [158.94.208.175]:49243: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-01-31 13:14:08 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:48832: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:14:39 dovecot_login authenticator failed for H=(mw9wOynP2s) [158.94.208.175]:63134: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.52
country_id: 1733045
description:
2026-01-31 13:14:47 dovecot_login authenticator failed for H=([49.124.151.52]) [49.124.151.52]:55240: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-31 13:14:03 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:50230: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.174.225.57
country_id: 1210997
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/yaml/Tests/Fixtures/index.yml HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:14:17 dovecot_login authenticator failed for H=(jM2WuPA1Di) [158.94.209.22]:58588: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: urban.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home/urban/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-31 13:14:26 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:56081: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.102
country_id: 1149361
description:
2026-01-31 13:14:36 dovecot_login authenticator failed for H=([180.94.75.102]) [180.94.75.102]:52377: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.134
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/css/responsive.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
country_id: 1835841
description:
2026-01-31 13:15:22 dovecot_login authenticator failed for H=([175.206.113.91]) [175.206.113.91]:58930: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:15:27 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.22.251.23
country_id: 1835841
description:
2026-01-31 13:15:07 dovecot_login authenticator failed for H=([59.22.251.23]) [59.22.251.23]:42804: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.8.48.178
country_id: 1605651
description:
2026-01-31 13:15:21 dovecot_login authenticator failed for H=ppp-58-8-48-178.revip2.asianet.co.th [58.8.48.178]:48834: 535 Incorrect authentication data (set_id=amir)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/img/photos/images/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.145
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/fonts/flaticon.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.132
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/css/font-awesome.min.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.67.44.254
country_id: 3017382
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/product-detail.php?id=744397 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.143
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/css/magnific-popup.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:15:02 dovecot_login authenticator failed for H=(7pQbf5) [158.94.208.175]:53901: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.231.31.220
country_id: 1605651
description:
2026-01-31 13:15:02 dovecot_login authenticator failed for H=([49.231.31.220]) [49.231.31.220]:5653: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.181.81.150
country_id: 1269750
description:
2026-01-31 13:15:11 dovecot_login authenticator failed for H=([103.181.81.150]) [103.181.81.150]:46677: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:15:11 dovecot_login authenticator failed for H=(iSmXWvlA) [158.94.209.22]:51258: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.163.189.191
country_id: 2017370
description:
2026-01-31 13:15:23 dovecot_login authenticator failed for H=([46.163.189.191]) [46.163.189.191]:50174: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.137
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/css/bootstrap.min.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.152
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/css/off-canvas.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.149
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/css/rsmenu-main.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.150
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/css/animate.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.146
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/css/owl.carousel.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/services/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:16:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:16:22 dovecot_login authenticator failed for H=(6vxE8pc) [158.94.208.175]:55380: 535 Incorrect authentication data (set_id=euratech)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/images/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:16:05 dovecot_login authenticator failed for H=(7am0WO) [158.94.209.22]:60387: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:17:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:17:17 dovecot_login authenticator failed for H=(bcPnSVcDi) [158.94.209.22]:55667: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:17:33 dovecot_login authenticator failed for H=(nzVYmfYAOf) [158.94.208.175]:53110: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.46
country_id: 1269750
description:
2026-01-31 13:17:59 dovecot_login authenticator failed for H=([182.95.223.46]) [182.95.223.46]:55576: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.148.10
country_id: 1814991
description:
2026-01-31 13:17:55 dovecot_login authenticator failed for H=(hebei.18.121.in-addr.arpa) [121.18.148.10]:61112: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-01-31 13:18:03 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:36198: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:18:11 dovecot_login authenticator failed for H=(qVH9fkXA) [158.94.209.22]:64566: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.219.54
country_id: 1269750
description:
2026-01-31 13:18:33 dovecot_login authenticator failed for H=([128.185.219.54]) [128.185.219.54]:56012: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.149
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/masaakisb.com/wp-content/uploads/porto_styles/shortcodes.css?ver=6.1.2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.238
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/wp-content/themes/porto/fonts/fontawesome_optimized/fa-solid-900.woff2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:18:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-01-31 13:18:16 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:46984: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.213
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/wp-content/themes/porto-child/style.css?ver=6.4.7 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.244
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/wp-content/themes/porto/style.css?ver=6.4.7 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.148
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/wp-includes/css/dist/block-library/style.min.css?ver=6.4.7 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.174
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/masaakisb.com/wp-content/uploads/porto_styles/dynamic_style.css?ver=6.1.2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.234.8.114
country_id: 2017370
description:
2026-01-31 13:18:21 dovecot_login authenticator failed for H=([213.234.8.114]) [213.234.8.114]:42064: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.157
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/masaakisb.com/wp-content/uploads/porto_styles/js_composer.css?ver=6.1.2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.136
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/wp-content/plugins/revslider/sr6/assets/css/rs6.css?ver=6.7.18 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.172
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/wp-content/themes/porto/fonts/fontawesome_optimized/fa-brands-400.woff2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:18:38 dovecot_login authenticator failed for H=(GUp45A) [158.94.208.175]:55992: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:18:29 dovecot_login authenticator failed for H=(SCjcmGq) [158.94.209.22]:51087: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.2.154.236
country_id: 3608932
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/products/em-pb-2/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.237
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.9.3 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.200
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/wp-content/themes/porto/css/theme.css?ver=6.4.7 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.230
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/wp-content/themes/porto/fonts/fontawesome_optimized/fa-regular-400.woff2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:19:05 dovecot_login authenticator failed for H=(LMsitHyST) [158.94.209.22]:56888: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.249.160.173
country_id: 3996063
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=35051528706619 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:19:04 dovecot_login authenticator failed for H=(Royil7) [158.94.208.175]:55712: 535 Incorrect authentication data (set_id=euratech)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/portfolio/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.86.102
country_id: 1269750
description:
2026-01-31 13:19:06 dovecot_login authenticator failed for H=(nsg-corporate-161.229.186.122.airtel.in) [182.79.86.102]:52790: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 13:19:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:20:17 dovecot_login authenticator failed for H=(ICvMF2) [158.94.209.22]:52207: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:20:35 dovecot_login authenticator failed for H=(sQoRglGhua) [158.94.208.175]:52274: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.215.235.125
country_id: 1831722
description:
2026-01-31 13:20:43 dovecot_login authenticator failed for H=(ADMIN) [188.215.235.125]:44950: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.71.84.38
country_id: 3469034
description:
2026-01-31 13:20:46 dovecot_login authenticator failed for H=([200.71.84.38]) [200.71.84.38]:34438: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.183.18
country_id: 1269750
description:
2026-01-31 13:20:56 dovecot_login authenticator failed for H=(nsg-static-057.137.71.182.airtel.in) [125.23.183.18]:45306: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 13:21:11 dovecot_login authenticator failed for H=(R9hB7WGIL) [158.94.209.22]:60890: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:21:22 dovecot_login authenticator failed for H=(vAix3NR6gB) [158.94.208.175]:49652: 535 Incorrect authentication data (set_id=euratech)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.237.211.243
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=88931514863850 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.245.243.150
country_id: 3996063
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/hamcrest/hamcrest-php/generator/FactoryCall.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 13:22:42 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:11594: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 13:22:13 dovecot_login authenticator failed for H=(UHS2jQeLr) [158.94.208.175]:55780: 535 Incorrect authentication data (set_id=euratech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-01-31 13:22:24 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:37398: 535 Incorrect authentication data (set_id=info@ocned.com)


