# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.189.232
country_id: 2017370
description:
2026-01-30 21:29:06 dovecot_login authenticator failed for H=(host-232.185.15.189.0.0xffffff00.sterling.stercom.ru) [185.15.189.232]:51540: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:30:02 dovecot_login authenticator failed for H=(1BeONnk) [185.230.124.69]:64577: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:30:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@col.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:30:01 dovecot_login authenticator failed for H=(AwelGqyD) [178.16.54.22]:49193: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:31:18 dovecot_login authenticator failed for H=(xdDDVNmy2J) [178.16.54.22]:65161: 535 Incorrect authentication data (set_id=alanlai)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.121.16.21
country_id: 1643084
domain: pftfood.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:82073.pftfood.com||ServerName:pftfood.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:239146263edd52dafe335adf1c3e550d20643ff7||Title:0x395250a6||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:31:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 21:31:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alanlai has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:31:14 dovecot_login authenticator failed for H=(fwoQDcnHt) [185.230.124.69]:52478: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/druma_photos/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.60.46
country_id: 1168579
description:
2026-01-30 21:32:46 dovecot_login authenticator failed for H=([203.124.60.46]) [203.124.60.46]:46057: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:32:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@col.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-30 21:32:18 +0800] info [cpaneld] 202.178.120.157 - KIk! "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.187
country_id: 1668284
description:
2026-01-30 21:32:25 dovecot_login authenticator failed for H=111-70-49-187.emome-ip.hinet.net [111.70.49.187]:58467: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:32:01 dovecot_login authenticator failed for H=(NufvMw0) [185.230.124.69]:49946: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 21:32:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alanlai has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:32:16 dovecot_login authenticator failed for H=(MGw3QoaO) [178.16.54.22]:49595: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:32:07 dovecot_login authenticator failed for H=(O9ppWx0uf) [185.230.124.69]:56779: 535 Incorrect authentication data (set_id=marketing@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.227.63.227
country_id: 2921044
description:
2026-01-30 21:32:47 dovecot_plain authenticator failed for H=([212.227.63.227]) [212.227.63.227]:51894: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 21:33:37 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alanlai has been locked for the attacker IP 178.16.54.22


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:33:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:33:13 dovecot_login authenticator failed for H=(jMapSc) [185.230.124.69]:52235: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:33:15 dovecot_login authenticator failed for H=(cPAzMzrUQ) [178.16.54.22]:63377: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.232.19.229
country_id: 1814991
description:
2026-01-30 21:34:30 dovecot_login authenticator failed for H=([116.232.19.229]) [116.232.19.229]:49144: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-01-30 21:34:12 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [116.98.104.138]:58630: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 21:34:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alanlai has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:34:20 dovecot_login authenticator failed for H=(ZHEnVd) [178.16.54.22]:62491: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:34:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:34:02 dovecot_login authenticator failed for H=(H1zWB4Hpy5) [185.230.124.69]:63240: 535 Incorrect authentication data (set_id=marketing@col.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.22.197.188
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=795780 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:34:48 dovecot_login authenticator failed for H=(VDC40xnX) [185.230.124.69]:54688: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:35:18 dovecot_login authenticator failed for H=(eL6uwW) [178.16.54.22]:58063: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:35:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:35:12 dovecot_login authenticator failed for H=(bkp4YYQLC) [185.230.124.69]:53118: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 21:35:38 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alanlai has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.131.243.102
country_id: 1814991
description:
2026-01-30 21:36:15 dovecot_login authenticator failed for H=([183.131.243.102]) [183.131.243.102]:54684: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.242.61.9
country_id: 1814991
description:
2026-01-30 21:36:05 dovecot_login authenticator failed for H=([114.242.61.9]) [114.242.61.9]:48324: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
country_id: 1814991
description:
2026-01-30 21:36:38 dovecot_login authenticator failed for H=([116.113.254.26]) [116.113.254.26]:54638: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:36:01 dovecot_login authenticator failed for H=(jQ8UUf) [185.230.124.69]:55308: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:36:21 dovecot_login authenticator failed for H=(Od4OBGuCNE) [178.16.54.22]:51344: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-30 21:36:50 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:12054: 535 Incorrect authentication data (set_id=chew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.185.37.239
country_id: 1269750
description:
2026-01-30 21:37:38 dovecot_login authenticator failed for H=(abts-tn-dynamic-239.37.185.136.airtelbroadband.in) [136.185.37.239]:54571: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2026-01-30 21:37:18 dovecot_login authenticator failed for H=([84.213.189.154]) [84.213.189.154]:58760: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.84.98
country_id: 798544
description:
2026-01-30 21:37:21 dovecot_login authenticator failed for H=(98.84.41.31.ip4.feromedia.eu) [31.41.84.98]:45512: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-01-30 21:37:38 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:44910: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
country_id: 1861060
description:
2026-01-30 21:37:46 dovecot_login authenticator failed for H=7.248.146.34.bc.googleusercontent.com [34.146.248.7]:51410: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.169.1.172
country_id: 1562822
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/services.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:37:13 dovecot_login authenticator failed for H=(y195CHbSJC) [185.230.124.69]:58912: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:37:02 dovecot_login authenticator failed for H=(f2dEXSk) [178.16.54.22]:61219: 535 Incorrect authentication data (set_id=alanlai)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/bin/psysh.bat||User:visoftcom||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:37:41 dovecot_login authenticator failed for H=(Fn3TVSU6C) [185.230.124.69]:52107: 535 Incorrect authentication data (set_id=marketing@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.102
country_id: 1269750
description:
2026-01-30 21:37:34 dovecot_login authenticator failed for H=(nsg-corporate-9.90.186.122.airtel.in) [182.95.228.102]:48592: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.172.79.51
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=192351 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:38:01 dovecot_login authenticator failed for H=(61IFTljgJi) [178.16.54.22]:53505: 535 Incorrect authentication data (set_id=bentey)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.35.80.233
country_id: 2635167
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/kitchen/8/708/890622 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/bin/doctrine-dbal.bat||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:38:06 dovecot_login authenticator failed for H=(cVLHuN9y) [185.230.124.69]:49745: 535 Incorrect authentication data (set_id=marketing@col.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:38:52 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@col.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:39:09 dovecot_login authenticator failed for H=(nj31U0CsF) [185.230.124.69]:60500: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:39:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@col.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-01-30 21:39:25 dovecot_login authenticator failed for H=(nsg-static-217.97.72.182.airtel.in) [182.95.228.194]:44438: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:39:04 dovecot_login authenticator failed for H=(etuDvDG) [178.16.54.22]:60196: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.170
country_id: 99237
description:
2026-01-30 21:39:08 dovecot_login authenticator failed for H=([65.20.251.170]) [65.20.251.170]:33884: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.51.179
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=159341 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.166
country_id: 2750405
description:
2026-01-30 21:40:04 1045805 [Warning] Aborted connection 1045805 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.166' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:40:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@col.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:40:12 dovecot_login authenticator failed for H=(WMwgQ30R7T) [185.230.124.69]:52642: 535 Incorrect authentication data (set_id=marketing@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:40:05 dovecot_login authenticator failed for H=(APMAkm11Z) [178.16.54.22]:58247: 535 Incorrect authentication data (set_id=bentey)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.80.162
country_id: 99237
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=778095 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.11.28
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/service.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.207.41.209
country_id: 6290252
description:
2026-01-30 21:40:48 dovecot_login authenticator failed for H=([109.207.41.209]) [109.207.41.209]:43447: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:40:23 dovecot_login authenticator failed for H=(VfMmj14r) [185.230.124.69]:63446: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.246.31.172
country_id: 1814991
description:
2026-01-30 21:40:26 dovecot_login authenticator failed for H=([116.246.31.172]) [116.246.31.172]:45786: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.184.107.129
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=1&page_id=1&sub=30 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.177.210.193
country_id: 3469034
description:
2026-01-30 21:41:45 dovecot_login authenticator failed for H=(193.210.177.45.fronteirainternet.com.br) [45.177.210.193]:62655: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:41:01 dovecot_login authenticator failed for H=(bTsIAIPE) [185.230.124.69]:55847: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/storage/logs/laravel.log||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:41:06 dovecot_login authenticator failed for H=(35NXkoLi) [178.16.54.22]:55784: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.167.187.153
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=308206 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.229.11
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=435578 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:41:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@col.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:42:09 dovecot_login authenticator failed for H=(kOCoV12FN) [185.230.124.69]:55771: 535 Incorrect authentication data (set_id=marketing@col.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.178.72.44
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=1&sub=27 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:42:59 dovecot_login authenticator failed for H=(L10bS5IsmS) [185.230.124.69]:58335: 535 Incorrect authentication data (set_id=marketing@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.73.94
country_id: 1269750
description:
2026-01-30 21:42:07 dovecot_login authenticator failed for H=([125.19.196.193]) [182.78.73.94]:34012: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:42:11 dovecot_login authenticator failed for H=(QC529q3ZVp) [178.16.54.22]:59535: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:42:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@col.com.my has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/bin/phpunit.bat||User:visoftcom||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.23.217.102
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=5&page_id=1&sub=18 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-01-30 21:43:01 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:43580: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-30 21:43:04 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:13669: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/maatwebsite/excel/dump.rdb||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2026-01-30 21:43:40 dovecot_login authenticator failed for H=(nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:39772: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
country_id: 1814991
description:
2026-01-30 21:43:48 dovecot_login authenticator failed for H=([116.113.254.26]) [116.113.254.26]:49618: 535 Incorrect authentication data (set_id=prayerlink)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 122.165.41.227
country_id: 1269750
description:
[2026-01-30 21:44:00 +0800] info [whostmgrd] 122.165.41.227 - root "GET /libraries/bootstrap/optimized/fonts/glyphicons-halflings-regular.woff HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [103.214.234.27] != Current IP Address [122.165.41.227]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:43:16 dovecot_login authenticator failed for H=(DGkf4bhFj) [185.230.124.69]:57121: 535 Incorrect authentication data (set_id=marketing@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-01-30 21:43:23 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:45288: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.225.4
country_id: 1269750
description:
2026-01-30 21:43:47 dovecot_login authenticator failed for H=([203.129.225.4]) [203.129.225.4]:59070: 535 Incorrect authentication data (set_id=intercessors)


plugin: ossec
rule: 11011
name: WHM SSO login failed
abuser: 122.165.41.227
country_id: 1269750
description:
[2026-01-30 21:44:00 +0800] info [whostmgrd] 122.165.41.227 PURGE root:vwdi_d5iu2X_RXti badpass [cookie ip check: IP address has changed: IP Address [103.214.234.27] != Current IP Address [122.165.41.227]]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:43:11 dovecot_login authenticator failed for H=(YtaJqiG) [178.16.54.22]:63007: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:43:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@col.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-30 21:43:16 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:57731: 535 Incorrect authentication data (set_id=zulkifli.abdul-mutalib@cofreth.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 117.120.26.49
country_id: 1831722
description:
[2026-01-30 21:43:26 +0800] info [cpaneld] 117.120.26.49 - oxboldc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.50.199.9
country_id: 1733045
description:
[2026-01-30 21:44:49 +0800] info [webmaild] 60.50.199.9 - horizon@tst-ma.com "GET /cpsess3570780216/3rdparty/roundcube/?_task=mail&_action=list&_layout=widescreen&_mbox=INBOX&_page=1&_remote=1&_unlock=loading1769780689373&_=1769680632810 HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.136
country_id: 1819730
description:
2026-01-30 21:44:41 dovecot_login authenticator failed for H=136.151.48.116.static.netvigator.com [116.48.151.136]:63686: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-01-30 21:44:01 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:40271: 535 Incorrect authentication data (set_id=project@tujusetia.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.196.63.93
country_id: 6252001
description:
[2026-01-30 21:44:10 +0800] info [whostmgrd] 73.196.63.93 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.87.170.189
country_id: 1880251
description:
2026-01-30 21:44:26 dovecot_plain authenticator failed for H=(7eucqn1lpu668vth4emu1sivhj1g21) [180.87.170.189]:23374: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:44:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.36.218.143
country_id: 1269750
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=435053 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.186
country_id: 2750405
description:
2026-01-30 21:44:36 1045967 [Warning] Aborted connection 1045967 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.186' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-01-30 21:45:01 dovecot_login authenticator failed for H=([171.244.60.35]) [171.244.60.35]:57310: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:44:19 dovecot_login authenticator failed for H=(OTIBLs) [178.16.54.22]:51882: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:44:18 dovecot_login authenticator failed for H=(XXB9bo54Rj) [185.230.124.69]:60945: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.164.1.238
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=4&page_id=1 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.50.199.9
country_id: 1733045
description:
[2026-01-30 21:45:05 +0800] info [webmaild] 60.50.199.9 - horizon@tst-ma.com "GET /cpsess3570780216/3rdparty/roundcube/?_task=mail&_action=list&_layout=widescreen&_mbox=INBOX&_page=1&_remote=1&_unlock=loading1769780705119&_=1769680632812 HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:45:08 dovecot_login authenticator failed for H=(yKUUxvU5) [185.230.124.69]:56830: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.109.25.93
country_id: 1643084
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=434148 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:45:10 dovecot_login authenticator failed for H=(9LZjf6Du) [178.16.54.22]:55532: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.14.249.50
country_id: 99237
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?page_id=8 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.168.171.249
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=11341523582879 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.247.177.140
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=539500 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.115.45.103
country_id: 953987
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=1&page_id=1&sub=33 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.68.245.47
country_id: 798544
description:
2026-01-30 21:46:29 dovecot_login authenticator failed for H=89-68-245-47.dynamic.play.pl [89.68.245.47]:59339: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.24.151.211
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=5&page_id=1&sub=28 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:46:04 dovecot_login authenticator failed for H=(xdVJl6) [185.230.124.69]:64029: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:46:04 dovecot_login authenticator failed for H=(IPjTyBZKv) [178.16.54.22]:63233: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:46:04 dovecot_login authenticator failed for H=(99lKastROx) [185.230.124.69]:61988: 535 Incorrect authentication data (set_id=marketing@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.163.127.14
country_id: 1269750
description:
2026-01-30 21:46:20 dovecot_login authenticator failed for H=(abts-north-dynamic-014.127.163.122.airtelbroadband.in) [122.163.127.14]:54319: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.170.37.28
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=5 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-01-30 21:47:57 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:23062: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:47:06 dovecot_login authenticator failed for H=(J2abwsM) [178.16.54.22]:57521: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.164.180.17
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=5&page_id=1&sub=25 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.148.0.202
country_id: 6252001
description:
2026-01-30 21:47:44 dovecot_login authenticator failed for H=syn-131-148-000-202.biz.spectrum.com [131.148.0.202]:64894: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.168.51.201
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?page_id=15 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:47:42 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@col.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.98.212.74
country_id: 1835841
description:
2026-01-30 21:47:59 dovecot_login authenticator failed for H=([183.98.212.74]) [183.98.212.74]:33859: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.47.153.133
country_id: 1269750
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=232442 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:47:14 dovecot_login authenticator failed for H=(tsrDXIFbZ) [185.230.124.69]:59524: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.74.71.17
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/enquiry.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-01-30 21:48:56 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:39197: 535 Incorrect authentication data (set_id=hafizi)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.86.190.148
country_id: 690791
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=4&page_id=1&sub=2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:48:55 dovecot_login authenticator failed for H=(dahcM13z) [185.230.124.69]:60221: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:48:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@col.com.my has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.24.87.169
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=235857 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.186
country_id: 2750405
description:
2026-01-30 21:48:05 1046124 [Warning] Aborted connection 1046124 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.186' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.187.207.18
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/resize.php?h=360&img=img/category_photos/59477378.jpg&w=360 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:48:04 dovecot_login authenticator failed for H=(ws4pEWea) [185.230.124.69]:59548: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:48:07 dovecot_login authenticator failed for H=(pMGFqUV7) [178.16.54.22]:55527: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.250.44.123
country_id: 1643084
description:
[2026-01-30 21:48:40 +0800] info [cpaneld] 180.250.44.123 - adssadadsa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user adssadadsa (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:49:10 dovecot_login authenticator failed for H=(QassbI) [178.16.54.22]:49763: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.58.49
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=212395 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 98.95.177.220
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/131.0.0.0 Safari/537.36||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-30 21:49:38 +0800] info [cpaneld] 202.178.120.157 - kik! "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:49:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/plug/sms/img/product.php||SC:/home2/pspolycom/public_html/plug||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.28.0.155
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=8&page_id=1&sub=13 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:49:19 dovecot_login authenticator failed for H=(0GOM9QIPVh) [185.230.124.69]:58894: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 103.214.234.27
country_id: 1269750
description:
[2026-01-30 21:50:08 +0800] info [whostmgrd] 103.214.234.27 - root "GET /cpsess4516104758/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [122.165.41.227] != Current IP Address [103.214.234.27]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:50:09 dovecot_login authenticator failed for H=(zHF0qDg) [178.16.54.22]:64595: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:50:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.98.68.199
country_id: 1835841
description:
2026-01-30 21:50:45 dovecot_login authenticator failed for H=([183.98.68.199]) [183.98.68.199]:45229: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.169.52.67
country_id: 2017370
description:
2026-01-30 21:50:53 dovecot_login authenticator failed for H=([193.169.52.67]) [193.169.52.67]:45080: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:50:03 dovecot_login authenticator failed for H=(56IaXn3) [185.230.124.69]:62192: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.166.102.186
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=5&sub=18 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.7.78.226
country_id: 2510769
description:
2026-01-30 21:50:59 dovecot_login authenticator failed for H=226.red-88-7-78.staticip.rima-tde.net [88.7.78.226]:55996: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 103.214.234.27
country_id: 1269750
description:
[2026-01-30 21:51:03 +0800] info [whostmgrd] 103.214.234.27 - root "GET /cpsess4516104758/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [122.165.41.227] != Current IP Address [103.214.234.27]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-01-30 21:51:06 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:29562: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:51:36 dovecot_login authenticator failed for H=(pyynUN) [185.230.124.69]:49346: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.161.127.73
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/news-detail.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.237.71.202
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=192351 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:51:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.167.51.24
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=942713 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.166
country_id: 2750405
description:
2026-01-30 21:51:27 1046303 [Warning] Aborted connection 1046303 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.166' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.81.55.119
country_id: 3469034
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=222966 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:51:14 dovecot_login authenticator failed for H=(hn29Um) [178.16.54.22]:52115: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.227.91.109
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=7&page_id=1&sub=42 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:51:04 dovecot_login authenticator failed for H=(9lyZAZ) [185.230.124.69]:61926: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.190.32.167
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=336637 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:52:18 dovecot_login authenticator failed for H=(3Gx1lY) [185.230.124.69]:53105: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:52:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.168.149.252
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=1&page_id=1&sub=35 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.161.93.203
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=527241 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.163.215.50
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=1&sub=37 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.190.173
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=4&page_id=1&sub=3 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2026-01-30 21:53:01 dovecot_login authenticator failed for H=(nsg-corporate-72.152.185.122.airtel.in) [122.187.222.54]:40968: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.166
country_id: 2750405
description:
2026-01-30 21:53:01 1046385 [Warning] Aborted connection 1046385 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.166' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:52:22 dovecot_login authenticator failed for H=(eGyj2D131) [178.16.54.22]:53357: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.99.52.202
country_id: 1835841
description:
2026-01-30 21:52:45 dovecot_login authenticator failed for H=([222.99.52.202]) [222.99.52.202]:57333: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.177.63.56
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=260012 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:53:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 103.214.234.27
country_id: 1269750
description:
[2026-01-30 21:53:17 +0800] info [whostmgrd] 103.214.234.27 - root "GET /cpsess4516104758/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [122.165.41.227] != Current IP Address [103.214.234.27]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:53:08 dovecot_login authenticator failed for H=(lFDoMfyH) [185.230.124.69]:62119: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:53:15 dovecot_login authenticator failed for H=(VCrUZuLO) [178.16.54.22]:53021: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 21:53:16 dovecot_login authenticator failed for H=(aNV6Lzdxy) [178.16.54.138]:51952: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.62.205.232
country_id: 2750405
description:
2026-01-30 21:53:34 dovecot_login authenticator failed for H=77-62-205-232.mobile.kpn.net [77.62.205.232]:44384: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.31.158
country_id: 3017382
description:
2026-01-30 21:53:29 dovecot_plain authenticator failed for H=laubervilliers-657-1-93-158.w80-14.abo.wanadoo.fr (panned) [80.14.31.158]:41457: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.86
country_id: 1269750
description:
2026-01-30 21:54:24 dovecot_login authenticator failed for H=([125.17.17.201]) [27.123.113.86]:34714: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.158.30.193
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/http-foundation/Tests/ResponseHeaderBagTest.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:54:16 dovecot_login authenticator failed for H=(ErhNZb) [185.230.124.69]:49383: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:54:29 dovecot_login authenticator failed for H=(XmkqQoMhPV) [185.230.124.69]:49306: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:54:05 dovecot_login authenticator failed for H=(CH04fuU5lL) [178.16.54.22]:52585: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 103.214.234.27
country_id: 1269750
description:
[2026-01-30 21:54:14 +0800] info [whostmgrd] 103.214.234.27 - root "GET /cpsess4516104758/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [122.165.41.227] != Current IP Address [103.214.234.27]


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 21:54:37 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alanlai@mckd.com.my has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.218.57.50
country_id: 3996063
description:
2026-01-30 21:54:12 dovecot_login authenticator failed for H=(customer-187-218-57-50.uninet-ide.com.mx) [187.218.57.50]:53881: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 21:54:18 dovecot_login authenticator failed for H=(HupyDIL9KJ) [178.16.54.138]:49601: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:54:27 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 21:55:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alanlai@mckd.com.my has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:55:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 21:55:48 dovecot_login authenticator failed for H=(XTfGgVGNo) [178.16.54.138]:63736: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/project.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:55:11 dovecot_login authenticator failed for H=(AtmrE0FZk) [185.230.124.69]:60306: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:55:19 dovecot_login authenticator failed for H=(j6uo81) [178.16.54.22]:65118: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 103.214.234.27
country_id: 1269750
description:
[2026-01-30 21:55:27 +0800] info [whostmgrd] 103.214.234.27 - root "GET /cpsess4516104758/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [122.165.41.227] != Current IP Address [103.214.234.27]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.226.217.82
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/teamwork.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 21:56:52 dovecot_login authenticator failed for H=(NfdOkLAKm1) [178.16.54.138]:56814: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.172.82.246
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=5&page_id=1&sub=26 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.255.188.120
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=697884 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 21:56:05 dovecot_login authenticator failed for H=(Jf8yox5dB) [2.58.56.77]:50505: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:56:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.17.233.154
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=268452 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.169.127.204
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=135803 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 21:56:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bentey has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 103.214.234.27
country_id: 1269750
description:
[2026-01-30 21:56:28 +0800] info [whostmgrd] 103.214.234.27 - root "GET /cpsess4516104758/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [122.165.41.227] != Current IP Address [103.214.234.27]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:56:19 dovecot_login authenticator failed for H=(pheF6YTqNs) [185.230.124.69]:49663: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:56:24 dovecot_login authenticator failed for H=(WKLxhMI) [178.16.54.22]:57460: 535 Incorrect authentication data (set_id=bentey)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/home/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 103.232.219.60
country_id: 1733045
description:
[2026-01-30 21:56:06 +0800] info [webmaild] 103.232.219.60 - teressa@smartcable.com.my "POST /cpsess0429253840/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [180.75.72.60] != Current IP Address [103.232.219.60]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:57:06 dovecot_login authenticator failed for H=(tDojY4) [178.16.54.22]:63919: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:57:12 dovecot_login authenticator failed for H=(ZmvjSwoBg) [185.230.124.69]:50711: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.227.85.214
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=740138 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:57:03 dovecot_login authenticator failed for H=(2XFhe6Wm1) [185.230.124.69]:61531: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 21:57:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bentey has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:57:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 21:57:22 dovecot_login authenticator failed for H=(ay9LoDTN) [2.58.56.77]:49587: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 21:57:50 dovecot_login authenticator failed for H=(3SfdCwq) [178.16.54.138]:65350: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:58:17 dovecot_login authenticator failed for H=(b7eGiy) [185.230.124.69]:58623: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 21:58:22 dovecot_login authenticator failed for H=(7hHUH5sc) [178.16.54.138]:55750: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.183.134.124
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=224566 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.173.190.139
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/oriental.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:58:02 dovecot_login authenticator failed for H=(CjMxcDHv4U) [178.16.54.22]:52552: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.27.69.235
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=444310 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.237.177.239
country_id: 1562822
description:
2026-01-30 21:58:34 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [171.237.177.239]:14140: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 21:58:10 dovecot_login authenticator failed for H=(gVSsWHu) [2.58.56.77]:63537: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:58:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.172.228.48
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.214.117.130
country_id: 953987
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?page_id=27 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 21:58:00 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alanlai@mckd.com.my has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.91.179.26
country_id: 732800
description:
2026-01-30 21:58:01 dovecot_login authenticator failed for H=(213-91-179-26.btc-net.bg) [213.91.179.26]:48600: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 103.214.234.27
country_id: 1269750
description:
[2026-01-30 21:58:49 +0800] info [whostmgrd] 103.214.234.27 - root "GET /cpsess4516104758/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [122.165.41.227] != Current IP Address [103.214.234.27]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 103.214.234.27
country_id: 1269750
description:
[2026-01-30 21:59:03 +0800] info [whostmgrd] 103.214.234.27 - root "GET /cpsess4516104758/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [122.165.41.227] != Current IP Address [103.214.234.27]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 21:59:14 dovecot_login authenticator failed for H=(KD8UTg) [178.16.54.138]:49561: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 21:59:15 dovecot_login authenticator failed for H=(f5nO1sRFn9) [2.58.56.77]:60721: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 21:59:39 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 21:59:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 21:59:17 dovecot_login authenticator failed for H=(1NqE0MYor) [178.16.54.22]:52944: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.178.192.172
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=794941 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 21:59:07 dovecot_login authenticator failed for H=(ew9H9Uu) [185.230.124.69]:63700: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 22:00:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 104.143.84.54
country_id: 6252001
domain: www.mssa.org.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/139.0.7258.5 Safari/537.36||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.181.3.12
country_id: 3469034
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?page_id=7 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 98.95.177.220
country_id: 6252001
domain: www.agpc.org.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/109.0.5414.119 Safari/537.36||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 103.214.234.27
country_id: 1269750
description:
[2026-01-30 22:00:00 +0800] info [whostmgrd] 103.214.234.27 - root "GET /cpsess4516104758/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [122.165.41.227] != Current IP Address [103.214.234.27]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:00:02 dovecot_login authenticator failed for H=(fLQY5XOFO) [185.230.124.69]:59404: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:00:09 dovecot_login authenticator failed for H=(r0Jx4KQ14F) [178.16.54.22]:60869: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:00:01 dovecot_login authenticator failed for H=(8B6fwFu) [185.230.124.69]:61715: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:00:04 dovecot_login authenticator failed for H=(5xNVF0fz) [2.58.56.77]:64586: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:00:14 dovecot_login authenticator failed for H=(gmcWT3eEnT) [178.16.54.138]:63288: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.189
country_id: 6252001
description:
2026-01-30 22:00:53 dovecot_login authenticator failed for H=([209.23.72.189]) [209.23.72.189]:56230: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:00:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.94.144
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?page_id=19 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 22:01:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:01:08 dovecot_login authenticator failed for H=(tJZfV6Xo) [185.230.124.69]:56983: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:01:12 dovecot_login authenticator failed for H=(7frCu0iJP) [178.16.54.22]:62153: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:01:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/dRuma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.23.88.218
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=913632 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:01:15 dovecot_login authenticator failed for H=(o6v7GL0xVN) [2.58.56.77]:57985: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.234.13.32
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=670775 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:01:13 dovecot_login authenticator failed for H=(vTrm8pggTP) [178.16.54.138]:60301: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.122.134.175
country_id: 3469034
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=514257 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.254.217.203
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=5&page_id=3 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:02:01 dovecot_login authenticator failed for H=(TfjDtm) [2.58.56.77]:57911: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:02:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.214.160.4
country_id: 2017370
description:
2026-01-30 22:02:27 dovecot_login authenticator failed for H=(pool.luganet.ru) [178.214.160.4]:49055: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:02:41 dovecot_login authenticator failed for H=(1oyZ9rXpYr) [178.16.54.138]:58796: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:02:05 dovecot_login authenticator failed for H=(TGmN55) [185.230.124.69]:62087: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:02:13 dovecot_login authenticator failed for H=(BFPxTKENsr) [178.16.54.22]:50403: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.189.232
country_id: 2017370
description:
2026-01-30 22:02:18 dovecot_login authenticator failed for H=(host-232.185.15.189.0.0xffffff00.sterling.stercom.ru) [185.15.189.232]:50358: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:02:55 dovecot_login authenticator failed for H=(EtaUB2Rb) [185.230.124.69]:57824: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2026-01-30 22:02:50 dovecot_login authenticator failed for H=(177-0-238-190.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:36214: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.236.159.37
country_id: 1814991
description:
2026-01-30 22:03:02 dovecot_login authenticator failed for H=([120.236.159.37]) [120.236.159.37]:41627: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:03:10 dovecot_login authenticator failed for H=(BpOtxr) [2.58.56.77]:51275: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:03:20 dovecot_login authenticator failed for H=(TicSEt) [185.230.124.69]:55759: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 22:03:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/symfony/translation/Resources/schemas/xliff-core-1.2-strict.xsd||User:visoftcom||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:03:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:03:11 dovecot_login authenticator failed for H=(QaApzK) [178.16.54.138]:52056: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:03:11 dovecot_login authenticator failed for H=(0OolsQ) [178.16.54.22]:50112: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:04:04 dovecot_login authenticator failed for H=(qg3CYlHZ) [185.230.124.69]:64643: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:04:11 dovecot_login authenticator failed for H=(QV3nttZ) [178.16.54.138]:56880: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 30 22:04:39 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@aire-fresh.com has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:04:16 dovecot_login authenticator failed for H=(sQumEgjVrK) [178.16.54.22]:51502: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 22:04:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.227.214.54
country_id: 3469034
description:
2026-01-30 22:04:41 dovecot_plain authenticator failed for H=(V4836VC8A) [186.227.214.54]:36029: 535 Incorrect authentication data (set_id=rnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:04:24 dovecot_login authenticator failed for H=(O6kMOT) [2.58.56.77]:53251: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.233.38.143
country_id: 1668284
description:
2026-01-30 22:04:52 dovecot_plain authenticator failed for H=36-233-38-143.dynamic-ip.hinet.net (I7QG1XB55L1Y) [36.233.38.143]:8846: 535 Incorrect authentication data (set_id=rohaidaak@euratech.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.161.17
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=480397 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:05:41 dovecot_login authenticator failed for H=(4NdeF0aq) [178.16.54.138]:50194: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 22:05:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:05:16 dovecot_login authenticator failed for H=(diV39vBW) [178.16.54.22]:51832: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.200.142
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=8&sub=12 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:05:16 dovecot_login authenticator failed for H=(IUR1vrY) [185.230.124.69]:50432: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:05:12 dovecot_login authenticator failed for H=(KmZxZNK) [2.58.56.77]:60565: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 30 22:05:39 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@aire-fresh.com has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:05:40 dovecot_login authenticator failed for H=(rhFvPD) [185.230.124.69]:62163: 535 Incorrect authentication data (set_id=marketing@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:06:07 dovecot_login authenticator failed for H=(yPR3J8v) [185.230.124.69]:64234: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 30 22:06:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@aire-fresh.com has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.228.65.185
country_id: 294640
description:
2026-01-30 22:06:31 dovecot_plain authenticator failed for H=(GXA8DC) [176.228.65.185]:61138: 535 Incorrect authentication data (set_id=abhan@euratech.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.85.72
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=978506 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:06:17 dovecot_login authenticator failed for H=(KgPYavM) [178.16.54.22]:65504: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:06:22 dovecot_login authenticator failed for H=(okYhd9WH) [2.58.56.77]:61817: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-30 22:06:32 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:39900: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.50
country_id: 1269750
description:
2026-01-30 22:06:59 dovecot_login authenticator failed for H=([182.95.63.50]) [182.95.63.50]:42312: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 22:06:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:06:11 dovecot_login authenticator failed for H=(3Is2yfNSgO) [178.16.54.138]:56310: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.17.4.130
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=841251 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.172.237.28
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=171212 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.23.45.47
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=159611 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:07:23 dovecot_login authenticator failed for H=(wQXAeU) [185.230.124.69]:55300: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.228.164.236
country_id: 2017370
description:
2026-01-30 22:07:37 dovecot_login authenticator failed for H=([193.228.164.236]) [193.228.164.236]:35432: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:07:08 dovecot_login authenticator failed for H=(UB4YhV7) [2.58.56.77]:64747: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.183.180.108
country_id: 1814991
description:
2026-01-30 22:07:16 dovecot_login authenticator failed for H=([118.183.180.108]) [118.183.180.108]:30522: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 203.144.76.188
country_id: 1831722
description:
Jan 30 22:07:49 sv3 pure-ftpd[3483041]: (?@203.144.76.188) [WARNING] Authentication failed for user [chew]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.1.58
country_id: 1668284
description:
2026-01-30 22:07:24 dovecot_login authenticator failed for H=([101.13.1.58]) [101.13.1.58]:48790: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.60.211.114
country_id: 6252001
description:
2026-01-30 22:07:34 dovecot_login authenticator failed for H=67-60-211-114.cpe.sparklight.net [67.60.211.114]:51022: 535 Incorrect authentication data (set_id=chew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:07:06 dovecot_login authenticator failed for H=(9rPXph) [178.16.54.138]:50094: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.19.12
country_id: 3144096
description:
2026-01-30 22:07:10 dovecot_login authenticator failed for H=(cm-84.211.19.12.get.no) [84.211.19.12]:39864: 535 Incorrect authentication data (set_id=chew)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.248.30.180
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=8&sub=7 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:07:18 dovecot_login authenticator failed for H=(GJs9EwYZ) [178.16.54.22]:55827: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 22:07:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 203.144.76.188
country_id: 1831722
description:
Jan 30 22:07:46 sv3 pure-ftpd[3483041]: (?@203.144.76.188) [INFO] New connection from 203.144.76.188


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 30 22:07:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@aire-fresh.com has been locked for the attacker IP 178.16.54.138


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/symfony/http-kernel/Tests/DataCollector/Compiler.log||User:visoftcom||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/fphortier/images/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:08:07 dovecot_login authenticator failed for H=(Zv9R9c35) [185.230.124.69]:57539: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:08:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:08:21 dovecot_login authenticator failed for H=(KsVmvq) [178.16.54.22]:56974: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 30 22:08:40 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@aire-fresh.com has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:08:16 dovecot_login authenticator failed for H=(xn5LWqD5) [2.58.56.77]:52949: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:08:42 dovecot_login authenticator failed for H=(0SHoIrIDIN) [178.16.54.138]:50036: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:08:33 dovecot_login authenticator failed for H=(7jRHwdB) [185.230.124.69]:57170: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.178.37.170
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/index.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:09:15 dovecot_login authenticator failed for H=(8h3XKp) [178.16.54.138]:54473: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.93.214
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?page_id=5 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:09:02 dovecot_login authenticator failed for H=(0DSiQGl9) [178.16.54.22]:62781: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:09:04 dovecot_login authenticator failed for H=(Lft74o) [185.230.124.69]:65114: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:09:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.97.41
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=993425 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:09:02 dovecot_login authenticator failed for H=(6ekLWXA) [2.58.56.77]:54484: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - boss@astlog.com.my [01/30/2026:14:10:31 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: boss@astlog.com.my


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/fphortier/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:10:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.187
country_id: 1269750
description:
2026-01-30 22:10:30 dovecot_login authenticator failed for H=(nsg-corporate-187.230.187.122.airtel.in) [122.187.230.187]:56437: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.223.96.43
country_id: 2661886
domain: zrrtc.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home2/dpscomsec/public_html/assets||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.188.246.136
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=145994 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2026-01-30 22:10:56 dovecot_login authenticator failed for H=([220.93.167.144]) [220.93.167.144]:58164: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:10:14 dovecot_login authenticator failed for H=(Go5pGZdRmi) [178.16.54.138]:64742: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-30 22:10:27 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:60669: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 116.109.37.121
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=241640 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 192.241.150.89
country_id: 6252001
description:
2026-01-30 22:10:48 1047131 [Warning] Aborted connection 1047131 to db: 'unconnected' user: 'unauthenticated' host: '192.241.150.89' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:10:11 dovecot_login authenticator failed for H=(fbYxKVtpmY) [178.16.54.22]:60886: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 22:10:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:10:22 dovecot_login authenticator failed for H=(Q6dGQKw39) [185.230.124.69]:55845: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 68.183.141.28
country_id: 6252001
description:
2026-01-30 22:10:47 1047130 [Warning] Aborted connection 1047130 to db: 'unconnected' user: 'unauthenticated' host: '68.183.141.28' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.140
country_id: 1835841
description:
2026-01-30 22:10:48 dovecot_login authenticator failed for H=([120.29.140.140]) [120.29.140.140]:56707: 535 Incorrect authentication data (set_id=zulkifli.abdul-mutalib@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:10:09 dovecot_login authenticator failed for H=(dPZO07QOBp) [2.58.56.77]:63990: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:11:07 dovecot_login authenticator failed for H=(DrIEiMJ) [185.230.124.69]:64109: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2026-01-30 22:11:32 dovecot_login authenticator failed for H=([83.239.84.130]) [83.239.84.130]:32976: 535 Incorrect authentication data (set_id=prayerlink)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.223.96.43
country_id: 2661886
domain: zrrtc.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/dpscomsec/public_html/wp-admin||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.91.95
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=783496 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 22:11:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:11:14 dovecot_login authenticator failed for H=(rG8KKGuc) [178.16.54.22]:64303: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.243.58
country_id: 1814991
description:
2026-01-30 22:12:00 dovecot_login authenticator failed for H=([218.21.243.58]) [218.21.243.58]:39778: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:11:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 103.121.16.21
country_id: 1643084
domain: pftfood.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.71||T:APACHE||MV:/wp-json/wp/v2/users||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.11.64.42
country_id: 1668284
description:
2026-01-30 22:11:58 dovecot_login authenticator failed for H=124-11-64-42.static.tfn.net.tw [124.11.64.42]:55671: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:11:32 dovecot_login authenticator failed for H=(mPRHit) [185.230.124.69]:61982: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.59.196
country_id: 798544
description:
2026-01-30 22:11:18 dovecot_login authenticator failed for H=(ADMIN) [138.199.59.196]:24704: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:11:40 dovecot_login authenticator failed for H=(oR6q7WP7mE) [178.16.54.138]:52202: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:11:23 dovecot_login authenticator failed for H=(lieGeGUJL) [2.58.56.77]:59582: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.108
country_id: 1814991
description:
2026-01-30 22:11:48 dovecot_login authenticator failed for H=([111.61.97.108]) [111.61.97.108]:42226: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.184.50.42
country_id: 1643084
description:
2026-01-30 22:12:25 dovecot_plain authenticator failed for H=(6LCBR6) [103.184.50.42]:57099: 535 Incorrect authentication data (set_id=rohaidaak@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:12:09 dovecot_login authenticator failed for H=(E0Yadk) [2.58.56.77]:57243: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:12:16 dovecot_login authenticator failed for H=(cYs6eJHBEx) [178.16.54.22]:58482: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 183.98.212.74
country_id: 1835841
description:
Jan 30 22:12:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account marketing has been temporarily locked by Imunify PAM(183.98.212.74)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.98.212.74
country_id: 1835841
description:
2026-01-30 22:12:27 dovecot_login authenticator failed for H=([183.98.212.74]) [183.98.212.74]:50152: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:12:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.254.86.155
country_id: 2215636
description:
2026-01-30 22:12:08 dovecot_plain authenticator failed for H=(648A5DR0V5VM) [41.254.86.155]:52751: 535 Incorrect authentication data (set_id=rnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:12:08 dovecot_login authenticator failed for H=(kznEwcO) [185.230.124.69]:60019: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:12:35 dovecot_login authenticator failed for H=(0zUlI86bok) [178.16.54.138]:64735: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 22:12:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 22:13:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:13:21 dovecot_login authenticator failed for H=(3GNXDf3X) [178.16.54.22]:61522: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.121.16.21
country_id: 1643084
domain: pftfood.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.pftfood.com||ServerName:pftfood.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4acb3fbe3640912ba9c3f077cbd29d3ebc206acc||Title:0x88f862f5||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:13:16 dovecot_login authenticator failed for H=(CMf7pI) [2.58.56.77]:51717: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-01-30 22:13:38 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:49741: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2026-01-30 22:13:48 dovecot_login authenticator failed for H=(nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:35873: 535 Incorrect authentication data (set_id=hafizi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:13:05 dovecot_login authenticator failed for H=(J8Z8wp) [178.16.54.138]:65019: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:13:11 dovecot_login authenticator failed for H=(bWquETUgVd) [185.230.124.69]:60708: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.146
country_id: 1269750
description:
2026-01-30 22:14:54 dovecot_login authenticator failed for H=([182.95.85.103]) [182.95.112.146]:41638: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:14:08 dovecot_login authenticator failed for H=(V6FoYu) [178.16.54.138]:62763: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:14:13 dovecot_login authenticator failed for H=(XcCJK1qUFh) [178.16.54.22]:49427: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:14:29 dovecot_login authenticator failed for H=(fvZ0BIMmjx) [185.230.124.69]:54366: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:14:24 dovecot_login authenticator failed for H=(NJdNSSkeTb) [2.58.56.77]:59817: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.142.134
country_id: 1733045
description:
2026-01-30 22:14:26 dovecot_login authenticator failed for H=([49.124.142.134]) [49.124.142.134]:48630: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.56
country_id: 2017370
description:
2026-01-30 22:14:46 dovecot_login authenticator failed for H=([178.178.222.56]) [178.178.222.56]:42452: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.121.16.21
country_id: 1643084
domain: pftfood.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.pftfood.com||ServerName:pftfood.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b26bd549f13b7a974eb0b582677cc3dc52848a94||Title:0xbeac5a8f||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 22:14:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:14:03 dovecot_login authenticator failed for H=(u5oZFcGTz) [185.230.124.69]:49290: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.121.16.21
country_id: 1643084
domain: pftfood.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.pftfood.com||ServerName:pftfood.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7de6effafd0047edb908458d4f8d1747714d917c||Title:0xb3931140||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.128.55.242
country_id: 1814991
description:
2026-01-30 22:15:22 dovecot_login authenticator failed for H=([219.128.55.242]) [219.128.55.242]:53652: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:15:06 dovecot_login authenticator failed for H=(ZgUzxFdNQ) [178.16.54.22]:60105: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:15:11 dovecot_login authenticator failed for H=(ABJqwI240) [178.16.54.138]:60867: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpoffice/phpexcel/Documentation/assets/ClassDiagrams/Classes/PHPExcel_Reader_Excel2007.cs||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:15:27 dovecot_login authenticator failed for H=(EhTmdVzHmR) [185.230.124.69]:57353: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.219
country_id: 798544
description:
2026-01-30 22:15:41 dovecot_login authenticator failed for H=89-67-37-219.dynamic.play.pl [89.67.37.219]:38406: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:15:09 dovecot_login authenticator failed for H=(H0yd3r) [2.58.56.77]:63653: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.81.118.12
country_id: 1269750
domain: pspoly.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:74431.pspoly.com.my||ServerName:pspoly.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:85d0b796fb989842e909215ec90b3336c33659ed||Title:0x42dd0218||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:16:09 dovecot_login authenticator failed for H=(0HJNOMY1B) [178.16.54.138]:62593: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:16:13 dovecot_login authenticator failed for H=(HMhQ7swxF) [2.58.56.77]:49659: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:16:18 dovecot_login authenticator failed for H=(960gIIods5) [185.230.124.69]:60877: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:16:25 dovecot_login authenticator failed for H=(RvfftcqwE) [178.16.54.22]:52658: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:16:34 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.121.16.21
country_id: 1643084
domain: pftfood.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.pftfood.com||ServerName:pftfood.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d7afadb6186b88d55f26a9d12c370e204f147f12||Title:0x92cfc860||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/symfony/translation/Tests/fixtures/empty.ini||User:visoftcom||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.187
country_id: 2750405
description:
2026-01-30 22:17:16 1047383 [Warning] Aborted connection 1047383 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.187' (This connection closed normally without authentication)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpoffice/phpexcel/Documentation/assets/ClassDiagrams/Classes/PHPExcel_Writer_Serialized.cs||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:17:19 dovecot_login authenticator failed for H=(slw7ba) [2.58.56.77]:52408: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:17:07 dovecot_login authenticator failed for H=(qDhCsS) [178.16.54.138]:59676: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.121.16.21
country_id: 1643084
domain: pftfood.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.pftfood.com||ServerName:pftfood.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:32d5de6c65826266e5b3d03a6d134a1f10c17614||Title:0x972a0829||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 22:17:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bentey@mckd.com.my has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 30 22:17:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@aire-fresh.com has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:17:08 dovecot_login authenticator failed for H=(mV5jjKtz6H) [185.230.124.69]:61544: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:17:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:17:18 dovecot_login authenticator failed for H=(olmwvVW) [178.16.54.22]:49227: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:18:10 dovecot_login authenticator failed for H=(oADgffd) [178.16.54.22]:64472: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:18:34 dovecot_login authenticator failed for H=(AmclrI8MZ) [178.16.54.138]:59419: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:18:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:18:04 dovecot_login authenticator failed for H=(6hALtmS) [2.58.56.77]:62365: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 22:18:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bentey@mckd.com.my has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 22:18:47 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.121.16.21
country_id: 1643084
domain: pftfood.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.pftfood.com||ServerName:pftfood.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d29cc74527126e7dbc64e7610fff8f10c32ae0cb||Title:0xf231d465||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 30 22:18:32 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@aire-fresh.com has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:18:23 dovecot_login authenticator failed for H=(cfGsXASMMA) [185.230.124.69]:63393: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.24.41.71
country_id: 2017370
description:
2026-01-30 22:18:50 dovecot_login authenticator failed for H=pppoe-41-071.prtcom.ru [78.24.41.71]:56864: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpoffice/phpexcel/Documentation/assets/ClassDiagrams/Classes/IWriter.cs||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:19:21 dovecot_login authenticator failed for H=(0NiOzg) [2.58.56.77]:50514: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.121.16.21
country_id: 1643084
domain: pftfood.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.pftfood.com||ServerName:pftfood.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0909be4252dd91d901f5c7acc01dd5b13fd90c9c||Title:0x4cb1b136||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.187
country_id: 2750405
description:
2026-01-30 22:19:46 1047505 [Warning] Aborted connection 1047505 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.187' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
country_id: 1605651
description:
2026-01-30 22:19:09 dovecot_login authenticator failed for H=([110.77.137.236]) [110.77.137.236]:32902: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:19:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.26.55.2
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/young/19/720/1954521 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 22:19:26 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bentey@mckd.com.my has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:19:33 dovecot_login authenticator failed for H=(SuBnpygr1) [178.16.54.138]:56490: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:19:43 dovecot_login authenticator failed for H=(nlPCx4R3) [2.58.56.77]:51164: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:19:02 dovecot_login authenticator failed for H=(FxulEl) [178.16.54.22]:64967: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/symfony/translation/Tests/fixtures/resources.ini||User:visoftcom||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 22:19:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:19:14 dovecot_login authenticator failed for H=(pQECbx) [185.230.124.69]:50163: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 30 22:19:31 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@aire-fresh.com has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:20:08 dovecot_login authenticator failed for H=(eXD7qJ) [2.58.56.77]:63532: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:20:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.121.16.21
country_id: 1643084
domain: pftfood.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.pftfood.com||ServerName:pftfood.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:18a82c10d401550a7e7096bd812f8e2fe3423792||Title:0x5f3076e4||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:20:04 dovecot_login authenticator failed for H=(hgQOBs) [185.230.124.69]:56192: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:20:22 dovecot_login authenticator failed for H=(OvdLBd) [178.16.54.22]:54882: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 30 22:20:30 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@aire-fresh.com has been locked for the attacker IP 178.16.54.138


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpoffice/phpexcel/Documentation/assets/ClassDiagrams/Classes/PHPExcel_IOFactory.cs||User:visoftcom||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 22:20:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bentey@mckd.com.my has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:20:32 dovecot_login authenticator failed for H=(VV4B7O) [178.16.54.138]:51947: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 22:20:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 22:21:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bentey@mckd.com.my has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:21:15 dovecot_login authenticator failed for H=(P2SFoXC1Yq) [2.58.56.77]:55274: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpoffice/phpexcel/Documentation/assets/ClassDiagrams/Classes/Worksheet.cs||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.72.200
country_id: 2017370
description:
2026-01-30 22:21:31 dovecot_login authenticator failed for H=broadband-188-32-72-200.ip.moscow.rt.ru [188.32.72.200]:53568: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:21:51 dovecot_login authenticator failed for H=(ffNeif) [178.16.54.138]:64080: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:21:13 dovecot_login authenticator failed for H=(p4Zq5J) [185.230.124.69]:53976: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 22:21:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.27
country_id: 1733045
description:
2026-01-30 22:21:24 dovecot_login authenticator failed for H=([49.124.151.27]) [49.124.151.27]:49088: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.121.16.21
country_id: 1643084
domain: pftfood.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.pftfood.com||ServerName:pftfood.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:118add2d955a78e2f1ca4a11764ce68c83ffa63e||Title:0x6e6427c5||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:21:13 dovecot_login authenticator failed for H=(VaYh3jDy) [178.16.54.22]:58742: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.121.16.21
country_id: 1643084
domain: pftfood.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.pftfood.com||ServerName:pftfood.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b6c9d2456847f4460324eabec37df52119d5e1cc||Title:0x4176da43||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.173.141.231
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=442049 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:22:07 dovecot_login authenticator failed for H=(1Ro1bHG) [178.16.54.22]:52277: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 22:22:07 dovecot_login authenticator failed for H=(sOhbtI) [141.98.11.48]:51746: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:22:06 dovecot_login authenticator failed for H=(RlQRXjabru) [185.230.124.69]:62067: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/symfony/translation/Resources/schemas/xliff-core-1.2-strict.xsd||User:visoftcom||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 22:22:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:22:17 dovecot_login authenticator failed for H=(WVbwnHyOLS) [2.58.56.77]:65472: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:23:17 dovecot_login authenticator failed for H=(o0OqMAw) [178.16.54.138]:61913: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 22:23:00 dovecot_login authenticator failed for H=(MSsfE2c5) [141.98.11.48]:60010: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:23:01 dovecot_login authenticator failed for H=(hAJPAO6) [178.16.54.22]:51803: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.121.16.21
country_id: 1643084
domain: pftfood.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:pftfood.com.pftfood.com||ServerName:pftfood.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3e1b6ff5e04e591c3c38d9b234fa8ac6966f7d30||Title:0x23909d4b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 22:23:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.27.33.174
country_id: 6252001
description:
2026-01-30 22:23:51 dovecot_plain authenticator failed for H=c-73-27-33-174.hsd1.fl.comcast.net (horry) [73.27.33.174]:45048: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:23:11 dovecot_login authenticator failed for H=(xYL1phXLf4) [2.58.56.77]:49846: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:23:19 dovecot_login authenticator failed for H=(FhyQm5r4) [185.230.124.69]:57435: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/symfony/finder/Tests/Fixtures/A/a.dat||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 22:24:03 dovecot_login authenticator failed for H=(8Y1Tvey) [141.98.11.48]:51581: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:24:22 dovecot_login authenticator failed for H=(eGGmJ2Xg) [2.58.56.77]:64153: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:24:24 dovecot_login authenticator failed for H=(xJE1nuC) [178.16.54.22]:55110: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:24:58 dovecot_login authenticator failed for H=(WNnSNqU7) [185.230.124.69]:52735: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:24:08 dovecot_login authenticator failed for H=(4H3VGnkT) [185.230.124.69]:58757: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:24:24 dovecot_login authenticator failed for H=(Irw0FNJw) [178.16.54.138]:53259: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.121.16.21
country_id: 1643084
domain: pftfood.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:pftfood.com.pftfood.com||ServerName:pftfood.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4a370a276d50bfa10fcf13870e0d7abd35a54230||Title:0x4d495773||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.121.16.21
country_id: 1643084
domain: pftfood.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:pftfood.com.pftfood.com||ServerName:pftfood.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:011d982a81acabe6e21262adabeddce0d0cc4601||Title:0xe8b3920b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-30 22:25:59 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (sitlimip) [87.103.126.54]:11254: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:25:18 dovecot_login authenticator failed for H=(HIghZT) [178.16.54.138]:51950: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:25:22 dovecot_login authenticator failed for H=(Wi8wnClz) [185.230.124.69]:64468: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:25:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 22:25:09 dovecot_login authenticator failed for H=(6B7KID9) [141.98.11.48]:51747: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:25:08 dovecot_login authenticator failed for H=(NXydwKdj) [2.58.56.77]:54869: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:25:16 dovecot_login authenticator failed for H=(xCkgga) [178.16.54.22]:63961: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 22:26:03 dovecot_login authenticator failed for H=(Jb7nimWB) [141.98.11.48]:64207: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:26:18 dovecot_login authenticator failed for H=(mvBmJIiZ6) [185.230.124.69]:53307: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.237.90
country_id: 1269750
description:
2026-01-30 22:26:27 dovecot_login authenticator failed for H=([182.95.26.141]) [125.23.237.90]:33716: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.204.109
country_id: 3469034
description:
2026-01-30 22:26:09 dovecot_login authenticator failed for H=(igrejadorecreio.static.host.gvt.net.br) [186.215.204.109]:33968: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.121.16.21
country_id: 1643084
domain: pftfood.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:pftfood.com.pftfood.com||ServerName:pftfood.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bc83808f2ff0e8c93991ff762cc2fdf408fea6b0||Title:0x79b71a1a||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.165.226.97
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=2856 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:26:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:26:10 dovecot_login authenticator failed for H=(hHlTH7) [178.16.54.22]:54325: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:26:16 dovecot_login authenticator failed for H=(Km93ucY4) [2.58.56.77]:52241: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:27:00 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:27:02 dovecot_login authenticator failed for H=(htiU9qD82) [2.58.56.77]:59303: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:27:08 dovecot_login authenticator failed for H=(eA7FMZ) [185.230.124.69]:63427: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:27:12 dovecot_login authenticator failed for H=(owluYMD2) [178.16.54.138]:65439: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:27:24 dovecot_login authenticator failed for H=(tZ2ubgOr) [178.16.54.22]:50128: 535 Incorrect authentication data (set_id=bentey)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.121.16.21
country_id: 1643084
domain: pftfood.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:pftfood.com.pftfood.com||ServerName:pftfood.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1ab941307d9d63e5f97ee2184d1d4702d5fc4c10||Title:0xc168f8e0||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.48
country_id: 597427
description:
Jan 30 22:27:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 141.98.11.48


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 22:27:46 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.125.199.71
country_id: 6252001
description:
[2026-01-30 22:28:00 +0800] info [cpaneld] 71.125.199.71 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 22:27:10 dovecot_login authenticator failed for H=(xALHT2qV8) [141.98.11.48]:59594: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.48
country_id: 597427
description:
Jan 30 22:28:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 141.98.11.48


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.109.90.244
country_id: 6252001
description:
[2026-01-30 22:28:23 +0800] info [cpaneld] 174.109.90.244 - cofre "GET /login/?login_only=1&user=cofre&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofre (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.44.136.135
country_id: 6252001
description:
[2026-01-30 22:28:30 +0800] info [cpaneld] 24.44.136.135 - co "GET /login/?login_only=1&user=co&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user co (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.2.144.161
country_id: 6252001
description:
[2026-01-30 22:28:42 +0800] info [cpaneld] 73.2.144.161 - cofreth5 "GET /login/?login_only=1&user=cofreth5&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth5 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.132.198
country_id: 6252001
description:
2026-01-30 22:28:57 dovecot_login authenticator failed for H=(ADMIN) [79.127.132.198]:19635: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 22:28:00 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.178.144.84
country_id: 6252001
description:
[2026-01-30 22:28:01 +0800] info [cpaneld] 174.178.144.84 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.27.0.63
country_id: 6252001
description:
[2026-01-30 22:28:35 +0800] info [cpaneld] 65.27.0.63 - cofreth2 "GET /login/?login_only=1&user=cofreth2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.22.54.53
country_id: 6252001
description:
[2026-01-30 22:28:52 +0800] info [cpaneld] 70.22.54.53 - cofreth9 "GET /login/?login_only=1&user=cofreth9&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth9 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:28:08 dovecot_login authenticator failed for H=(8ZcQCMr) [178.16.54.138]:55814: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.237.180.144
country_id: 6252001
description:
[2026-01-30 22:28:26 +0800] info [cpaneld] 76.237.180.144 - cofr "GET /login/?login_only=1&user=cofr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.176.182.130
country_id: 6252001
description:
[2026-01-30 22:28:10 +0800] info [cpaneld] 66.176.182.130 - cofrethcom "GET /login/?login_only=1&user=cofrethcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.165.79.97
country_id: 6252001
description:
[2026-01-30 22:28:45 +0800] info [cpaneld] 97.165.79.97 - cofreth6 "GET /login/?login_only=1&user=cofreth6&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth6 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.17.168.203
country_id: 6252001
description:
[2026-01-30 22:28:47 +0800] info [cpaneld] 47.17.168.203 - cofreth7 "GET /login/?login_only=1&user=cofreth7&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth7 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.240.228
country_id: 6252001
description:
[2026-01-30 22:28:07 +0800] info [cpaneld] 172.58.240.228 - cofrethcomm "GET /login/?login_only=1&user=cofrethcomm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofrethcomm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.186.115.105
country_id: 6252001
description:
[2026-01-30 22:28:15 +0800] info [cpaneld] 68.186.115.105 - cofrethc "GET /login/?login_only=1&user=cofrethc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofrethc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.121.117.201
country_id: 6252001
description:
[2026-01-30 22:28:32 +0800] info [cpaneld] 98.121.117.201 - cofreth1 "GET /login/?login_only=1&user=cofreth1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.20.221.88
country_id: 6252001
description:
[2026-01-30 22:28:40 +0800] info [cpaneld] 73.20.221.88 - cofreth4 "GET /login/?login_only=1&user=cofreth4&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth4 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.255.201.4
country_id: 6252001
description:
[2026-01-30 22:28:04 +0800] info [cpaneld] 72.255.201.4 - cofreth "GET /login/?login_only=1&user=cofreth&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth (has_cpuser_file failed)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:28:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 165.16.188.225
country_id: 953987
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.aoto.com.my/product-detail.php?id=1816520570 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.204.97.200
country_id: 6252001
description:
[2026-01-30 22:28:28 +0800] info [cpaneld] 76.204.97.200 - cof "GET /login/?login_only=1&user=cof&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cof (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:28:02 dovecot_login authenticator failed for H=(o2DDdZye7) [185.230.124.69]:56321: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.149.46.128
country_id: 6252001
description:
[2026-01-30 22:28:05 +0800] info [cpaneld] 67.149.46.128 - cofrethcommy "GET /login/?login_only=1&user=cofrethcommy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofrethcommy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 12.74.99.99
country_id: 6252001
description:
[2026-01-30 22:28:50 +0800] info [cpaneld] 12.74.99.99 - cofreth8 "GET /login/?login_only=1&user=cofreth8&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth8 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.35.56.36
country_id: 6252001
description:
[2026-01-30 22:28:13 +0800] info [cpaneld] 24.35.56.36 - cofrethco "GET /login/?login_only=1&user=cofrethco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofrethco (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.121.16.21
country_id: 1643084
domain: pftfood.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:pftfood.com.pftfood.com||ServerName:pftfood.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f24e9fd577e66a69590dcaadd471a978efca7a03||Title:0x19727e0f||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:28:15 dovecot_login authenticator failed for H=(eKGSnFUxF) [178.16.54.22]:53827: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.39.160.132
country_id: 6252001
description:
[2026-01-30 22:28:20 +0800] info [cpaneld] 76.39.160.132 - cofret "GET /login/?login_only=1&user=cofret&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofret (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.222.56.54
country_id: 6252001
description:
[2026-01-30 22:28:37 +0800] info [cpaneld] 104.222.56.54 - cofreth3 "GET /login/?login_only=1&user=cofreth3&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth3 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:28:09 dovecot_login authenticator failed for H=(19iYgWP) [2.58.56.77]:59709: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 22:28:12 dovecot_login authenticator failed for H=(JKXhZr4P) [141.98.11.48]:55589: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:29:10 dovecot_login authenticator failed for H=(r4LdyAtn4) [185.230.124.69]:62525: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:29:17 dovecot_login authenticator failed for H=(mGkF8y6) [2.58.56.77]:56145: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 22:29:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:29:08 dovecot_login authenticator failed for H=(tulaADqXBy) [178.16.54.138]:58706: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 22:29:15 dovecot_login authenticator failed for H=(paUD1Cf3AO) [141.98.11.48]:64698: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:29:07 dovecot_login authenticator failed for H=(a3fQR5) [178.16.54.22]:60189: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:29:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.48
country_id: 597427
description:
Jan 30 22:29:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 141.98.11.48


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.121.16.21
country_id: 1643084
domain: pftfood.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:pftfood.com.pftfood.com||ServerName:pftfood.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9d4489bb1eb5b2c4cb0d6f86e3b3771f922e4f1b||Title:0x092d5029||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:30:01 dovecot_login authenticator failed for H=(bGItDFyZ) [185.230.124.69]:57750: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:30:27 dovecot_login authenticator failed for H=(tURlUOZ) [2.58.56.77]:62362: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 22:30:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account marketing has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.187
country_id: 2750405
description:
2026-01-30 22:30:25 1048224 [Warning] Aborted connection 1048224 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.187' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:30:27 dovecot_login authenticator failed for H=(zacSJC) [178.16.54.22]:61081: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:30:03 dovecot_login authenticator failed for H=(iAd20QCida) [178.16.54.138]:60265: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.121.16.21
country_id: 1643084
domain: pftfood.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:pftfood.com.pftfood.com||ServerName:pftfood.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:752dbd559a62807095b494472c1d297a9c9b2e83||Title:0xf1224d98||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-01-30 22:30:59 dovecot_login authenticator failed for H=(nsg-static-217.97.72.182.airtel.in) [182.95.228.194]:44070: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:30:04 dovecot_login authenticator failed for H=(5MB8KffHfM) [2.58.56.77]:64886: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 22:30:20 dovecot_login authenticator failed for H=(pzdXrG3K) [141.98.11.48]:52032: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.139
country_id: 6252001
description:
Jan 30 22:30:28 sv3 pure-ftpd[3498005]: (?@66.132.153.139) [INFO] New connection from 66.132.153.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:31:19 dovecot_login authenticator failed for H=(wxV6dSAoj) [178.16.54.22]:60089: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 22:31:24 dovecot_login authenticator failed for H=(ABJ8RX) [141.98.11.48]:55231: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.250.44.123
country_id: 1643084
description:
[2026-01-30 22:31:28 +0800] info [cpaneld] 180.250.44.123 - adssadadsa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user adssadadsa (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.121.16.21
country_id: 1643084
domain: pftfood.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:pftfood.com.pftfood.com||ServerName:pftfood.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:15328d2e911bccd7bb651e8a5a295a2971fd5f81||Title:0x8c25850d||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:31:10 dovecot_login authenticator failed for H=(zndMBtEE) [178.16.54.138]:50025: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:31:12 dovecot_login authenticator failed for H=(Hat0sub) [2.58.56.77]:64135: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:31:58 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch@nexuscollection.com has been temporarily locked by Imunify PAM(2.58.56.77)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2026-01-30 22:31:06 dovecot_login authenticator failed for H=([83.239.84.130]) [83.239.84.130]:44607: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 22:32:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bentey has been locked for the attacker IP 178.16.54.22


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 157.66.55.198
country_id: 1643084
domain: manforce.net
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/.wp-config.php.swp||User:manfotp3||


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 157.66.55.198
country_id: 1643084
domain: manforce.net
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:7.71||T:APACHE||MV:wp-config.php~||


plugin: modsec
rule: 77350222
name: IM360 WAF: Information disclosure in WPEngine plugin for WordPress
abuser: 157.66.55.198
country_id: 1643084
domain: manforce.net
description:
IM360 WAF: Information disclosure in WPEngine plugin for WordPress||MV:/_wpeprivate/config.json||RSV:7.71||T:APACHE||REQUEST_URI:/_wpeprivate/config.json||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 30 22:32:29 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@aire-fresh.com has been locked for the attacker IP 178.16.54.138


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.121.16.21
country_id: 1643084
domain: pftfood.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:pftfood.com.pftfood.com||ServerName:pftfood.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:974ec971b801aa66006de1a871b0e190e533534d||Title:0x963b6e6c||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:32:05 dovecot_login authenticator failed for H=(Dlfp7pp3B) [178.16.54.138]:58683: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:32:22 dovecot_login authenticator failed for H=(ph6dGgDj) [2.58.56.77]:65067: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:32:11 dovecot_login authenticator failed for H=(slnOBO) [178.16.54.22]:65019: 535 Incorrect authentication data (set_id=bentey)


plugin: modsec
rule: 77350212
name: IM360 WAF: Information Disclosure Attempt in WordPress
abuser: 157.66.55.198
country_id: 1643084
domain: manforce.net
description:
IM360 WAF: Information Disclosure Attempt in WordPress||MV:/wp-config.php~||RSV:7.71||T:APACHE||REQUEST_URI:/wp-config.php~||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:32:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch@nexuscollection.com has been temporarily locked by Imunify PAM(2.58.56.77)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.48
country_id: 597427
description:
Jan 30 22:32:28 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch@nexuscollection.com has been temporarily locked by Imunify PAM(141.98.11.48)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 22:32:30 dovecot_login authenticator failed for H=(AnTR4FBMi4) [141.98.11.48]:51166: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 116.106.204.177
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/training-details.php?id=203673 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.89.30.162
country_id: 3625428
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpunit/phpunit-mock-objects/tests/MockObject/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.94
country_id: 690791
description:
2026-01-30 22:33:19 H=([77.83.39.94]) [77.83.39.94]:60506 F=<sales@auersignal.com> rejected RCPT <enquiry@nexuscollection.com>: SPF: 77.83.39.94 is not allowed to send mail from auersignal.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.11.237
country_id: 1668284
description:
2026-01-30 22:33:24 dovecot_login authenticator failed for H=111-70-11-237.emome-ip.hinet.net [111.70.11.237]:46468: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.130
country_id: 1269750
description:
2026-01-30 22:33:38 dovecot_login authenticator failed for H=([182.95.58.130]) [182.95.58.130]:56702: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 22:33:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bentey has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.48
country_id: 597427
description:
Jan 30 22:33:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch@nexuscollection.com has been temporarily locked by Imunify PAM(141.98.11.48)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:33:05 dovecot_login authenticator failed for H=(gPCHuHL) [178.16.54.22]:63430: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:33:11 dovecot_login authenticator failed for H=(vUYpLo0OWz) [2.58.56.77]:50445: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.219.210.201
country_id: 192950
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpunit/phpunit-mock-objects/tests/MockObject HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 22:33:08 dovecot_login authenticator failed for H=(jw0GzbvWdW) [141.98.11.48]:59081: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:33:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch@nexuscollection.com has been temporarily locked by Imunify PAM(2.58.56.77)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.89.205.24
country_id: 1605651
description:
2026-01-30 22:33:43 dovecot_login authenticator failed for H=(mx-ll-183.89.205-24.dynamic.3bb.co.th) [183.89.205.24]:47904: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.33.47.2
country_id: 1835841
description:
2026-01-30 22:34:07 dovecot_login authenticator failed for H=([118.33.47.2]) [118.33.47.2]:37346: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 22:34:08 dovecot_login authenticator failed for H=(MvlWs6mWd) [141.98.11.48]:60206: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 30 22:34:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@aire-fresh.com has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 22:34:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bentey has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.48
country_id: 597427
description:
Jan 30 22:34:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch@nexuscollection.com has been temporarily locked by Imunify PAM(141.98.11.48)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:34:24 dovecot_login authenticator failed for H=(h15Z3E3) [2.58.56.77]:55617: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:34:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch@nexuscollection.com has been temporarily locked by Imunify PAM(2.58.56.77)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:34:23 dovecot_login authenticator failed for H=(wvUzw5) [178.16.54.22]:61021: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:34:17 dovecot_login authenticator failed for H=(NwurCcWriA) [178.16.54.138]:52065: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.48
country_id: 597427
description:
Jan 30 22:35:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch@nexuscollection.com has been temporarily locked by Imunify PAM(141.98.11.48)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 22:35:11 dovecot_login authenticator failed for H=(UR7HoF6Pf) [141.98.11.48]:54646: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:35:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch@nexuscollection.com has been temporarily locked by Imunify PAM(2.58.56.77)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:35:13 dovecot_login authenticator failed for H=(H6LnEzLAS) [2.58.56.77]:52479: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 22:35:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bentey has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:35:17 dovecot_login authenticator failed for H=(gnj7v8D) [178.16.54.22]:60265: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 167.94.138.115
country_id: 6252001
description:
2026-01-30 22:35:29 1048434 [Warning] Aborted connection 1048434 to db: 'unconnected' user: 'unauthenticated' host: '167.94.138.115' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 22:36:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bentey has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.48
country_id: 597427
description:
Jan 30 22:36:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch@nexuscollection.com has been temporarily locked by Imunify PAM(141.98.11.48)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 57.129.81.224
country_id: 2921044
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/img/img/demos/img/photos/img/photos/contact-us.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:36:05 dovecot_login authenticator failed for H=(pnJZ9gXgSy) [178.16.54.138]:49726: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/symfony/translation/Tests/fixtures/resourcebundle/corrupted/resources.dat||User:visoftcom||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:36:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch@nexuscollection.com has been temporarily locked by Imunify PAM(2.58.56.77)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 30 22:36:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@aire-fresh.com has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 22:36:13 dovecot_login authenticator failed for H=(eDTmt0Jk) [141.98.11.48]:65097: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:36:23 dovecot_login authenticator failed for H=(JkDcU5) [2.58.56.77]:52398: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:36:10 dovecot_login authenticator failed for H=(bLJH72Wrw) [178.16.54.22]:54292: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.206
country_id: 1269750
description:
2026-01-30 22:37:30 dovecot_login authenticator failed for H=(nsg-corporate-113.254.185.122.airtel.in) [122.186.64.206]:56632: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.183.66
country_id: 1269750
description:
2026-01-30 22:37:41 dovecot_login authenticator failed for H=([125.19.183.66]) [125.19.183.66]:59192: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 22:37:26 dovecot_login authenticator failed for H=(9j6rHMBqo) [141.98.11.48]:49404: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:37:02 dovecot_login authenticator failed for H=(cpFqCVg) [178.16.54.22]:58575: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.247.189.189
country_id: 6252001
description:
2026-01-30 22:37:09 dovecot_login authenticator failed for H=([50.247.189.189]) [50.247.189.189]:12606: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:37:12 dovecot_login authenticator failed for H=(k875Sic) [2.58.56.77]:63992: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.48.15.123
country_id: 6251999
description:
[2026-01-30 22:37:16 +0800] info [cpaneld] 86.48.15.123 - mkmetalc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.106.117
country_id: 1814991
description:
2026-01-30 22:37:22 dovecot_login authenticator failed for H=([111.26.106.117]) [111.26.106.117]:35990: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:37:51 dovecot_login authenticator failed for H=(kvs8Y3S3y9) [178.16.54.138]:55968: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2026-01-30 22:37:26 dovecot_login authenticator failed for H=([131.161.184.46]) [131.161.184.46]:60846: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/symfony/translation/Loader/schema/dic/xliff-core/xliff-core-1.2-strict.xsd||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 22:38:35 dovecot_login authenticator failed for H=(4op659Ewxg) [141.98.11.48]:53270: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.213.18.132
country_id: 6252001
description:
[2026-01-30 22:38:56 +0800] info [cpaneld] 209.213.18.132 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.232.38.71
country_id: 6252001
description:
[2026-01-30 22:38:58 +0800] info [cpaneld] 69.232.38.71 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:38:19 dovecot_login authenticator failed for H=(K3v6OQ2) [178.16.54.22]:60867: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:38:22 dovecot_login authenticator failed for H=(Bl5poU) [2.58.56.77]:64542: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.166
country_id: 1269750
description:
2026-01-30 22:38:36 dovecot_login authenticator failed for H=([125.19.175.250]) [122.185.146.166]:51028: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.29.191
country_id: 6252001
description:
[2026-01-30 22:39:13 +0800] info [cpaneld] 172.56.29.191 - ur "GET /login/?login_only=1&user=ur&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ur (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:39:05 dovecot_login authenticator failed for H=(m9VmCgK) [178.16.54.138]:55880: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:39:05 dovecot_login authenticator failed for H=(7yAKcWr6NB) [2.58.56.77]:63895: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 22:39:09 dovecot_login authenticator failed for H=(7z8uIkAmU) [141.98.11.48]:52368: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.12.138.30
country_id: 6252001
description:
[2026-01-30 22:39:01 +0800] info [cpaneld] 107.12.138.30 - urban "GET /login/?login_only=1&user=urban&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:39:12 dovecot_login authenticator failed for H=(2UHyhbI2) [178.16.54.22]:65145: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.185.95.101
country_id: 6252001
description:
[2026-01-30 22:39:10 +0800] info [cpaneld] 75.185.95.101 - urb "GET /login/?login_only=1&user=urb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user urb (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.158.176.28
country_id: 6252001
description:
[2026-01-30 22:39:03 +0800] info [cpaneld] 76.158.176.28 - urbanmy "GET /login/?login_only=1&user=urbanmy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user urbanmy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.116.213.54
country_id: 6252001
description:
[2026-01-30 22:39:07 +0800] info [cpaneld] 76.116.213.54 - urba "GET /login/?login_only=1&user=urba&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user urba (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 22:40:12 dovecot_login authenticator failed for H=(7SLOt3) [141.98.11.48]:59352: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:40:17 dovecot_login authenticator failed for H=(dU2QX6xcwH) [2.58.56.77]:51403: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:40:05 dovecot_login authenticator failed for H=(AqCr8FL) [178.16.54.22]:64909: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:40:39 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch@nexuscollection.com has been temporarily locked by Imunify PAM(2.58.56.77)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:40:06 dovecot_login authenticator failed for H=(9WlnQc) [178.16.54.138]:50592: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:41:23 dovecot_login authenticator failed for H=(PNXWhfvTSp) [178.16.54.22]:60958: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:41:23 dovecot_login authenticator failed for H=(m7byALV) [2.58.56.77]:58262: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 22:41:32 dovecot_login authenticator failed for H=(ARLJDU4Td) [141.98.11.48]:58493: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:41:08 dovecot_login authenticator failed for H=(7uhkuB) [178.16.54.138]:51274: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2026-01-30 22:41:13 dovecot_login authenticator failed for H=(syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:46359: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 22:41:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bentey has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.11.38
country_id: 1668284
description:
2026-01-30 22:41:27 dovecot_login authenticator failed for H=111-70-11-38.emome-ip.hinet.net [111.70.11.38]:53682: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:41:03 dovecot_login authenticator failed for H=(CN4dvRy1Q) [2.58.56.77]:64308: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:42:21 dovecot_login authenticator failed for H=(SH79MkrVU) [178.16.54.22]:58835: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.48
country_id: 597427
description:
Jan 30 22:42:33 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(141.98.11.48)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:42:44 dovecot_login authenticator failed for H=(SNR5NlhJV) [178.16.54.138]:49163: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.51.5
country_id: 1668284
description:
2026-01-30 22:42:46 dovecot_login authenticator failed for H=111-70-51-5.emome-ip.hinet.net [111.70.51.5]:60684: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 43.248.213.246
country_id: 1643084
description:
2026-01-30 22:43:00 1048697 [Warning] Aborted connection 1048697 to db: 'unconnected' user: 'unauthenticated' host: '43.248.213.246' (This connection closed normally without authentication)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 209.198.132.228
country_id: 69543
domain: rcct.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:17574.rcct.my||ServerName:rcct.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c320351442f985d29af84907e7829c5f2ba55413||Title:0x8317c20d||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 43.248.213.246
country_id: 1643084
description:
2026-01-30 22:42:59 1048690 [Warning] Aborted connection 1048690 to db: 'unconnected' user: 'unauthenticated' host: '43.248.213.246' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 22:42:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bentey has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:42:54 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(2.58.56.77)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.97.97
country_id: 1835841
description:
2026-01-30 22:42:56 dovecot_login authenticator failed for H=([211.228.97.97]) [211.228.97.97]:54555: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 22:42:05 dovecot_login authenticator failed for H=(vk1hCmN) [141.98.11.48]:63442: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:42:10 dovecot_login authenticator failed for H=(8Fa2JnuON) [2.58.56.77]:56234: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 43.248.213.246
country_id: 1643084
description:
2026-01-30 22:43:01 1048733 [Warning] Aborted connection 1048733 to db: 'unconnected' user: 'unauthenticated' host: '43.248.213.246' (This connection closed normally without authentication)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.48
country_id: 597427
description:
Jan 30 22:43:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(141.98.11.48)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:43:21 dovecot_login authenticator failed for H=(Co0djwW9) [2.58.56.77]:62427: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 22:43:07 dovecot_login authenticator failed for H=(SxcGfbt) [141.98.11.48]:64183: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 22:43:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bentey has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:43:14 dovecot_login authenticator failed for H=(Zxk0qS) [178.16.54.22]:59253: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.58.242
country_id: 1835841
description:
2026-01-30 22:43:18 dovecot_login authenticator failed for H=([61.72.58.242]) [61.72.58.242]:57586: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:43:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(2.58.56.77)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2026-01-30 22:43:53 dovecot_login authenticator failed for H=([27.123.119.235]) [122.185.176.126]:51088: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:44:06 dovecot_login authenticator failed for H=(VvJMsIxrYw) [178.16.54.22]:56119: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-30 22:44:21 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (gragar) [87.103.126.54]:1130: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 22:44:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bentey has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.242.220.232
country_id: 2921044
description:
2026-01-30 22:44:12 dovecot_login authenticator failed for H=232.220.242.35.bc.googleusercontent.com (10.156.0.2) [35.242.220.232]:50121: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:44:03 dovecot_login authenticator failed for H=(LtzZoSip) [178.16.54.138]:61909: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:44:08 dovecot_login authenticator failed for H=(6ytpBK) [2.58.56.77]:62761: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.63.87
country_id: 1814991
description:
2026-01-30 22:44:10 dovecot_login authenticator failed for H=([111.26.63.87]) [111.26.63.87]:40012: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.8.174
country_id: 1814991
description:
2026-01-30 22:44:23 dovecot_login authenticator failed for H=([60.166.8.174]) [60.166.8.174]:50862: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:44:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(2.58.56.77)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.48
country_id: 597427
description:
Jan 30 22:44:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(141.98.11.48)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 22:44:10 dovecot_login authenticator failed for H=(Q8JtkmcvOE) [141.98.11.48]:64484: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 22:45:15 dovecot_login authenticator failed for H=(CQi2V5p) [141.98.11.48]:61934: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:45:51 dovecot_login authenticator failed for H=(BH0swbol0) [178.16.54.22]:63913: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.48
country_id: 597427
description:
Jan 30 22:45:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(141.98.11.48)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:45:17 dovecot_login authenticator failed for H=(EbrEi4h) [2.58.56.77]:51994: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 20.163.15.178
country_id: 6252001
description:
2026-01-30 22:45:35 1048819 [Warning] Aborted connection 1048819 to db: 'unconnected' user: 'unauthenticated' host: '20.163.15.178' (This connection closed normally without authentication)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 20.163.15.178
country_id: 6252001
description:
2026-01-30 22:45:36 1048821 [Warning] Aborted connection 1048821 to db: 'unconnected' user: 'unauthenticated' host: '20.163.15.178' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 30 22:45:49 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bentey has been locked for the attacker IP 178.16.54.22


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/symfony/translation/Loader/schema/dic/xliff-core/xliff-core-2.0.xsd||User:visoftcom||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:45:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(2.58.56.77)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:45:17 dovecot_login authenticator failed for H=(Gx1zMOVcQ) [178.16.54.138]:58088: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 22:46:25 dovecot_login authenticator failed for H=(nXjoPqjhI) [141.98.11.48]:50569: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:46:39 dovecot_login authenticator failed for H=(INLsgm1Nc) [178.16.54.138]:53352: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:46:04 dovecot_login authenticator failed for H=(cE3Q0mumf) [2.58.56.77]:56696: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:46:19 dovecot_login authenticator failed for H=(BfWakC) [178.16.54.22]:64952: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:46:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(2.58.56.77)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.48
country_id: 597427
description:
Jan 30 22:46:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(141.98.11.48)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.81.137
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=672005 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/faq.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.38
country_id: 1269750
description:
2026-01-30 22:47:50 dovecot_login authenticator failed for H=(nsg-corporate-38.230.187.122.airtel.in) [122.187.230.38]:57342: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.13.71.126
country_id: 1814991
description:
2026-01-30 22:47:59 dovecot_login authenticator failed for H=(hn.kd.ny.adsl) [123.13.71.126]:7072: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.145.135.243
country_id: 6252001
description:
[2026-01-30 22:47:56 +0800] info [cpaneld] 35.145.135.243 - ajplantationscom "GET /login/?login_only=1&user=ajplantationscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajplantationscom (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:47:24 dovecot_login authenticator failed for H=(ILVTchQ) [178.16.54.22]:50669: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:47:08 dovecot_login authenticator failed for H=(oqBcIwd) [178.16.54.138]:60472: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.226.13.109
country_id: 6252001
description:
[2026-01-30 22:47:41 +0800] info [cpaneld] 162.226.13.109 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.147.118.174
country_id: 2017370
description:
2026-01-30 22:47:43 dovecot_login authenticator failed for H=(174.118.147.82.ekb.enforta.com) [82.147.118.174]:59696: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.60.46
country_id: 1168579
description:
2026-01-30 22:47:43 dovecot_login authenticator failed for H=([203.124.60.46]) [203.124.60.46]:37043: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:47:11 dovecot_login authenticator failed for H=(RPbVDj92M6) [2.58.56.77]:51588: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 43.248.213.246
country_id: 1643084
description:
2026-01-30 22:48:01 1048925 [Warning] Aborted connection 1048925 to db: 'unconnected' user: 'unauthenticated' host: '43.248.213.246' (This connection closed normally without authentication)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.112.41
country_id: 6252001
description:
[2026-01-30 22:47:53 +0800] info [cpaneld] 172.59.112.41 - ajplantationscomm "GET /login/?login_only=1&user=ajplantationscomm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajplantationscomm (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 22:47:27 dovecot_login authenticator failed for H=(xvp8VOMVi) [141.98.11.48]:61126: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.22.11.204
country_id: 6252001
description:
[2026-01-30 22:47:58 +0800] info [cpaneld] 134.22.11.204 - ajplantationsco "GET /login/?login_only=1&user=ajplantationsco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajplantationsco (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.113
country_id: 1733045
description:
2026-01-30 22:48:04 dovecot_login authenticator failed for H=([49.124.147.113]) [49.124.147.113]:58788: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 43.248.213.246
country_id: 1643084
description:
2026-01-30 22:48:02 1048933 [Warning] Aborted connection 1048933 to db: 'unconnected' user: 'unauthenticated' host: '43.248.213.246' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 22:48:32 dovecot_login authenticator failed for H=(YeaY1uBoBO) [141.98.11.48]:54750: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:48:57 dovecot_login authenticator failed for H=(P8GUaJK) [178.16.54.22]:56290: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.219.28.111
country_id: 6252001
description:
[2026-01-30 22:48:28 +0800] info [cpaneld] 47.219.28.111 - ajp "GET /login/?login_only=1&user=ajp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.72.15.243
country_id: 6252001
description:
[2026-01-30 22:48:33 +0800] info [cpaneld] 71.72.15.243 - ajplant1 "GET /login/?login_only=1&user=ajplant1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajplant1 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-01-30 22:48:37 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:52611: 535 Incorrect authentication data (set_id=zulkifli-abdul-mutalib@cofreth.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.228.18.71
country_id: 6252001
description:
[2026-01-30 22:48:52 +0800] info [cpaneld] 75.228.18.71 - ajplant8 "GET /login/?login_only=1&user=ajplant8&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajplant8 (has_cpuser_file failed)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 43.248.213.246
country_id: 1643084
description:
2026-01-30 22:48:02 1048927 [Warning] Aborted connection 1048927 to db: 'unconnected' user: 'unauthenticated' host: '43.248.213.246' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:48:04 dovecot_login authenticator failed for H=(CDUdZX9MC) [2.58.56.77]:58535: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.64.254
country_id: 6252001
description:
[2026-01-30 22:48:44 +0800] info [cpaneld] 172.56.64.254 - ajplant5 "GET /login/?login_only=1&user=ajplant5&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajplant5 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-01-30 22:48:47 dovecot_login authenticator failed for H=([197.219.208.58]) [197.219.208.58]:38798: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 12.23.103.90
country_id: 6252001
description:
[2026-01-30 22:48:09 +0800] info [cpaneld] 12.23.103.90 - ajplantati "GET /login/?login_only=1&user=ajplantati&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajplantati (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.130
country_id: 1269750
description:
2026-01-30 22:48:54 dovecot_login authenticator failed for H=(nsg-corporate-130.230.187.122.airtel.in) [122.187.230.130]:42695: 535 Incorrect authentication data (set_id=zulkifliabdul-mutalib@cofreth.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.34.163.132
country_id: 6252001
description:
[2026-01-30 22:48:17 +0800] info [cpaneld] 76.34.163.132 - ajplant "GET /login/?login_only=1&user=ajplant&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajplant (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.105.4.18
country_id: 6252001
description:
[2026-01-30 22:48:25 +0800] info [cpaneld] 207.105.4.18 - ajpl "GET /login/?login_only=1&user=ajpl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajpl (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.207.225.129
country_id: 2017370
description:
2026-01-30 22:48:40 dovecot_login authenticator failed for H=(pool-31-207-225-129.is74.ru) [31.207.225.129]:52032: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
country_id: 1835841
description:
2026-01-30 22:48:49 dovecot_login authenticator failed for H=([183.99.89.74]) [183.99.89.74]:35936: 535 Incorrect authentication data (set_id=abdul-mutalib.zulkifli@cofreth.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.207.157.243
country_id: 6252001
description:
[2026-01-30 22:48:54 +0800] info [cpaneld] 73.207.157.243 - ajplant9 "GET /login/?login_only=1&user=ajplant9&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajplant9 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.105.115.43
country_id: 6252001
description:
[2026-01-30 22:48:02 +0800] info [cpaneld] 74.105.115.43 - ajplantationsc "GET /login/?login_only=1&user=ajplantationsc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajplantationsc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.77.131.226
country_id: 6252001
description:
[2026-01-30 22:48:49 +0800] info [cpaneld] 172.77.131.226 - ajplant7 "GET /login/?login_only=1&user=ajplant7&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajplant7 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.81.32.40
country_id: 6252001
description:
[2026-01-30 22:48:14 +0800] info [cpaneld] 68.81.32.40 - ajplanta "GET /login/?login_only=1&user=ajplanta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajplanta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.230.78.246
country_id: 6252001
description:
[2026-01-30 22:48:30 +0800] info [cpaneld] 104.230.78.246 - aj "GET /login/?login_only=1&user=aj&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aj (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2026-01-30 22:48:43 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:37944: 535 Incorrect authentication data (set_id=abdul-mutalib@cofreth.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.102.28.150
country_id: 6252001
description:
[2026-01-30 22:48:35 +0800] info [cpaneld] 99.102.28.150 - ajplant2 "GET /login/?login_only=1&user=ajplant2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajplant2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.146.211.124
country_id: 6252001
description:
[2026-01-30 22:48:39 +0800] info [cpaneld] 24.146.211.124 - ajplant3 "GET /login/?login_only=1&user=ajplant3&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajplant3 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-01-30 22:48:44 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:47746: 535 Incorrect authentication data (set_id=abdul-mutalib_zulkifli@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2026-01-30 22:48:49 dovecot_login authenticator failed for H=net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:59997: 535 Incorrect authentication data (set_id=abdul-mutalib-zulkifli@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-30 22:48:04 dovecot_login authenticator failed for H=(XicixBHb) [178.16.54.138]:64588: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.5.115.33
country_id: 6252001
description:
[2026-01-30 22:48:06 +0800] info [cpaneld] 73.5.115.33 - ajplantatio "GET /login/?login_only=1&user=ajplantatio&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajplantatio (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.16.167.75
country_id: 6252001
description:
[2026-01-30 22:48:41 +0800] info [cpaneld] 75.16.167.75 - ajplant4 "GET /login/?login_only=1&user=ajplant4&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajplant4 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.136.201.131
country_id: 6252001
description:
[2026-01-30 22:48:04 +0800] info [cpaneld] 107.136.201.131 - ajplantation "GET /login/?login_only=1&user=ajplantation&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajplantation (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.110.181.67
country_id: 6252001
description:
[2026-01-30 22:48:46 +0800] info [cpaneld] 74.110.181.67 - ajplant6 "GET /login/?login_only=1&user=ajplant6&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajplant6 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.30.21
country_id: 1562822
description:
2026-01-30 22:48:03 dovecot_login authenticator failed for H=([27.71.30.21]) [27.71.30.21]:14531: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.37.190.163
country_id: 6252001
description:
[2026-01-30 22:48:19 +0800] info [cpaneld] 68.37.190.163 - ajplan "GET /login/?login_only=1&user=ajplan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajplan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.10.184.35
country_id: 6252001
description:
[2026-01-30 22:48:22 +0800] info [cpaneld] 67.10.184.35 - ajpla "GET /login/?login_only=1&user=ajpla&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajpla (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.81.116.54
country_id: 6252001
description:
[2026-01-30 22:48:11 +0800] info [cpaneld] 67.81.116.54 - ajplantat "GET /login/?login_only=1&user=ajplantat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajplantat (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-30 22:48:37 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:45522: 535 Incorrect authentication data (set_id=abdul-mutalibzulkifli@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 22:49:05 dovecot_login authenticator failed for H=(Lvgl4e0PS) [141.98.11.48]:51931: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2026-01-30 22:49:15 dovecot_login authenticator failed for H=(nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:39531: 535 Incorrect authentication data (set_id=zulkifli_abdul-mutalib@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-01-30 22:49:23 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:55202: 535 Incorrect authentication data (set_id=abdul-mutalib.zulkifli)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.48
country_id: 597427
description:
Jan 30 22:49:33 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch@nexuscollection.com has been temporarily locked by Imunify PAM(141.98.11.48)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-01-30 22:49:32 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:52450: 535 Incorrect authentication data (set_id=zulkifli.abdul-mutalib)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.222
country_id: 1819730
description:
2026-01-30 22:49:07 dovecot_login authenticator failed for H=222.42.246.220.static.netvigator.com [220.246.42.222]:58476: 535 Incorrect authentication data (set_id=abdul-mutalib-zulkifli)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-01-30 22:49:07 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:55192: 535 Incorrect authentication data (set_id=abdul-mutalib_zulkifli)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-01-30 22:49:45 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:37052: 535 Incorrect authentication data (set_id=abdul-mutalib.zulkifli)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
country_id: 1835841
description:
2026-01-30 22:49:25 dovecot_login authenticator failed for H=([121.178.185.141]) [121.178.185.141]:54064: 535 Incorrect authentication data (set_id=zulkifliabdul-mutalib)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:49:14 dovecot_login authenticator failed for H=(rHsci6k) [2.58.56.77]:62252: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.13
country_id: 1269750
description:
2026-01-30 22:49:02 dovecot_login authenticator failed for H=(nsg-corporate-13.230.187.122.airtel.in) [122.187.230.13]:60557: 535 Incorrect authentication data (set_id=zulkifli.abdul-mutalib@cofreth.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:49:35 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch@nexuscollection.com has been temporarily locked by Imunify PAM(2.58.56.77)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:49:31 dovecot_login authenticator failed for H=(v99ajqQH2O) [178.16.54.22]:57380: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.3.51.96
country_id: 6252001
description:
[2026-01-30 22:50:23 +0800] info [cpaneld] 45.3.51.96 - oxboldc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 22:50:06 dovecot_login authenticator failed for H=(tefkUh) [141.98.11.48]:55830: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.48
country_id: 597427
description:
Jan 30 22:50:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch@nexuscollection.com has been temporarily locked by Imunify PAM(141.98.11.48)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:50:02 dovecot_login authenticator failed for H=(dgu5Oa) [178.16.54.22]:51404: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:50:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch@nexuscollection.com has been temporarily locked by Imunify PAM(2.58.56.77)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:50:25 dovecot_login authenticator failed for H=(MBvKRp) [2.58.56.77]:52580: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 22:51:26 dovecot_login authenticator failed for H=(ezsonVnM) [141.98.11.48]:49598: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:51:24 dovecot_login authenticator failed for H=(uxQbFFB9Cv) [2.58.56.77]:53053: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:51:48 dovecot_login authenticator failed for H=(7yD7hOvdPt) [2.58.56.77]:60067: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:51:23 dovecot_login authenticator failed for H=(KO2yHu) [185.230.124.69]:52894: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.183.217.102
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=759894 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:51:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch@nexuscollection.com has been temporarily locked by Imunify PAM(2.58.56.77)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:51:34 dovecot_login authenticator failed for H=(Eljwnj6yt) [178.16.54.22]:54687: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.201.52
country_id: 1814991
description:
2026-01-30 22:51:36 dovecot_login authenticator failed for H=([58.16.201.52]) [58.16.201.52]:52436: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.48
country_id: 597427
description:
Jan 30 22:51:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch@nexuscollection.com has been temporarily locked by Imunify PAM(141.98.11.48)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:52:09 dovecot_login authenticator failed for H=(A4Gxvfb) [178.16.54.22]:53743: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.86
country_id: 1269750
description:
2026-01-30 22:52:09 dovecot_login authenticator failed for H=([27.123.113.86]) [27.123.113.86]:36802: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:52:13 dovecot_login authenticator failed for H=(0bh7Jo82s) [185.230.124.69]:58960: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 22:52:18 dovecot_login authenticator failed for H=(F2YjGw) [141.98.11.48]:49363: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/symfony/translation/Loader/schema/dic/xliff-core/xml.xsd||User:visoftcom||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:52:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch@nexuscollection.com has been temporarily locked by Imunify PAM(2.58.56.77)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.61.48.234
country_id: 1835841
description:
2026-01-30 22:52:37 dovecot_login authenticator failed for H=([125.61.48.234]) [125.61.48.234]:44722: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 15.204.94.173
country_id: 6252001
description:
2026-01-30 22:52:11 dovecot_login authenticator failed for H=vps-63db5216.vps.ovh.us [15.204.94.173]:35220: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.48
country_id: 597427
description:
Jan 30 22:52:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch@nexuscollection.com has been temporarily locked by Imunify PAM(141.98.11.48)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:52:10 dovecot_login authenticator failed for H=(OxGxO4smq1) [2.58.56.77]:61774: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:53:01 dovecot_login authenticator failed for H=(7lBOALu) [185.230.124.69]:56958: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 22:53:12 dovecot_login authenticator failed for H=(cyN1dNYzJg) [141.98.11.48]:49171: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:53:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch@nexuscollection.com has been temporarily locked by Imunify PAM(2.58.56.77)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:53:19 dovecot_login authenticator failed for H=(MGXS2gE5H) [2.58.56.77]:53299: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 106.75.141.82
country_id: 1814991
description:
2026-01-30 22:53:43 1049377 [Warning] Aborted connection 1049377 to db: 'unconnected' user: 'unauthenticated' host: '106.75.141.82' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/languages/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.143.237.31
country_id: 1210997
description:
2026-01-30 22:53:53 dovecot_plain authenticator failed for H=(CHXEI8NX18) [103.143.237.31]:56187: 535 Incorrect authentication data (set_id=rnd@plomalite.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.48
country_id: 597427
description:
Jan 30 22:53:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch@nexuscollection.com has been temporarily locked by Imunify PAM(141.98.11.48)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.158.116.222
country_id: 2400553
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/look/18/112/1853913 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.92.202
country_id: 1269750
description:
2026-01-30 22:54:45 dovecot_login authenticator failed for H=([27.123.92.202]) [27.123.92.202]:58980: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.170.15
country_id: 3175395
description:
2026-01-30 22:54:37 dovecot_plain authenticator failed for H=([100.64.100.6]) [2.57.170.15]:47269: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:54:01 dovecot_login authenticator failed for H=(oFOc0mdo) [2.58.56.77]:56940: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:54:17 dovecot_login authenticator failed for H=(OMngDlt4eE) [185.230.124.69]:54702: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:54:40 dovecot_login authenticator failed for H=(hY3ad761u) [178.16.54.22]:49734: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.248.146
country_id: 1269750
description:
2026-01-30 22:55:06 dovecot_login authenticator failed for H=([122.184.117.237]) [128.185.248.146]:38380: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:55:07 dovecot_login authenticator failed for H=(m4360h) [185.230.124.69]:60723: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:55:11 dovecot_login authenticator failed for H=(AToiBu1WV) [178.16.54.22]:55321: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:55:12 dovecot_login authenticator failed for H=(gUr0N1kXzK) [2.58.56.77]:52172: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.170.15
country_id: 3175395
description:
2026-01-30 22:55:11 dovecot_plain authenticator failed for H=([100.64.100.6]) [2.57.170.15]:37863: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 22:55:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 22:55:34 dovecot_login authenticator failed for H=(ewFat9) [141.98.11.48]:64290: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.99.52.202
country_id: 1835841
description:
2026-01-30 22:56:24 dovecot_login authenticator failed for H=([222.99.52.202]) [222.99.52.202]:42580: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.48.25.24
country_id: 6252001
description:
[2026-01-30 22:56:31 +0800] info [cpaneld] 86.48.25.24 - vcb "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vcb (has_cpuser_file failed)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/druma_photos/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:56:01 dovecot_login authenticator failed for H=(I70HAv2k) [185.230.124.69]:56745: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:56:18 dovecot_login authenticator failed for H=(UWd7Uah) [178.16.54.22]:56406: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:56:59 dovecot_login authenticator failed for H=(2hsHjaM) [2.58.56.77]:61207: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 22:56:03 dovecot_login authenticator failed for H=(5chc7M) [141.98.11.48]:56749: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:56:15 dovecot_login authenticator failed for H=(WesVa07jYW) [2.58.56.77]:61546: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 22:56:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.217
country_id: 1733045
description:
2026-01-30 22:56:37 dovecot_login authenticator failed for H=([49.124.149.217]) [49.124.149.217]:58262: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 22:57:34 dovecot_login authenticator failed for H=(HODABQzm) [141.98.11.48]:58643: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:57:48 dovecot_login authenticator failed for H=(Mtu6V80jh) [178.16.54.22]:56294: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:57:21 dovecot_login authenticator failed for H=(NQOHZzSU) [2.58.56.77]:50128: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 22:57:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:57:13 dovecot_login authenticator failed for H=(Va2jt3MZjR) [185.230.124.69]:57679: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:58:07 dovecot_login authenticator failed for H=(fBmPSU) [2.58.56.77]:51853: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:58:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:58:21 dovecot_login authenticator failed for H=(L11gMeyk) [178.16.54.22]:57066: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 22:58:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:58:15 dovecot_login authenticator failed for H=(KjZxpBqu) [185.230.124.69]:65396: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 22:58:08 dovecot_login authenticator failed for H=(uVZb8msW2f) [141.98.11.48]:56645: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 22:59:19 dovecot_login authenticator failed for H=(ynWzQkAqb) [2.58.56.77]:59521: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 22:59:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 22:59:12 dovecot_login authenticator failed for H=(4kJ4cT) [141.98.11.48]:59230: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 22:59:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 22:59:17 dovecot_login authenticator failed for H=(tykiPxNp) [185.230.124.69]:55239: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 22:59:24 dovecot_login authenticator failed for H=(u2oiAWkP) [178.16.54.22]:59396: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/symfony/http-kernel/Tests/DataCollector/Compiler.log||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.145.181.7
country_id: 1814991
description:
2026-01-30 23:00:18 dovecot_login authenticator failed for H=([61.145.181.7]) [61.145.181.7]:60322: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.255.50
country_id: 1269750
description:
2026-01-30 23:00:46 dovecot_login authenticator failed for H=([182.95.203.81]) [122.186.255.50]:48216: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:00:08 dovecot_login authenticator failed for H=(aQci0Dl1c) [185.230.124.69]:52147: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 23:00:13 dovecot_login authenticator failed for H=(1ljy1qnkxJ) [141.98.11.48]:61842: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.30.124.34
country_id: 1814991
description:
2026-01-30 23:00:43 dovecot_login authenticator failed for H=(dns58.online.tj.cn) [111.30.124.34]:1189: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:00:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:00:05 dovecot_login authenticator failed for H=(7iXJAJ0) [2.58.56.77]:65436: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.48
country_id: 597427
description:
Jan 30 23:00:42 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 141.98.11.48


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 44.202.231.158
country_id: 6252001
description:
Jan 30 23:01:56 sv3 pure-ftpd[3520045]: (?@44.202.231.158) [INFO] New connection from 44.202.231.158


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:01:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.48
country_id: 597427
description:
Jan 30 23:01:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 141.98.11.48


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.123.109.43
country_id: 732800
description:
2026-01-30 23:01:38 dovecot_login authenticator failed for H=(ADMIN) [93.123.109.43]:59758: 535 Incorrect authentication data (set_id=enquiry@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:01:10 dovecot_login authenticator failed for H=(iJoUPxcqS) [2.58.56.77]:60164: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:01:16 dovecot_login authenticator failed for H=(7QHQM6n) [185.230.124.69]:50336: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 23:01:28 dovecot_login authenticator failed for H=(HNGkDgWc) [178.16.54.22]:50219: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 23:01:13 dovecot_login authenticator failed for H=(dA15iXhxz) [141.98.11.48]:62326: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-30 23:01:01 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:13770: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpoffice/phpexcel/Documentation/assets/ClassDiagrams/ClassDiagrams.csproj||User:visoftcom||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.48
country_id: 597427
description:
Jan 30 23:02:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 141.98.11.48


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:02:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.61.0.253
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/astlog.com.my/wp-content/uploads/2025/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.48
country_id: 597427
description:
Jan 30 23:02:42 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch@nexuscollection.com has been temporarily locked by Imunify PAM(141.98.11.48)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.248.24.238
country_id: 798544
domain: lvconsult.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home/lvconsultcom/public_html/wp-admin/images/commentv.php||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:02:07 dovecot_login authenticator failed for H=(Y9TZbrInF) [185.230.124.69]:49450: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 23:02:12 dovecot_login authenticator failed for H=(Y3ADBjPq6M) [141.98.11.48]:63734: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:02:22 dovecot_login authenticator failed for H=(WmivfOSTk) [2.58.56.77]:51693: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:02:23 dovecot_login authenticator failed for H=(qncdzVhtd9) [185.230.124.69]:62034: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 23:03:05 dovecot_login authenticator failed for H=(e27B4g) [178.16.54.22]:61909: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 23:03:08 dovecot_login authenticator failed for H=(IClZwV) [141.98.11.48]:58634: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:03:13 dovecot_login authenticator failed for H=(DU6NU5W) [2.58.56.77]:64530: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:03:43 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:03:20 dovecot_login authenticator failed for H=(uudSGEYt4W) [185.230.124.69]:62308: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:04:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:04:09 dovecot_login authenticator failed for H=(1nmZfv) [185.230.124.69]:58571: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.102.122.20
country_id: 2017370
description:
2026-01-30 23:04:28 dovecot_login authenticator failed for H=([94.102.122.20]) [94.102.122.20]:55310: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.130
country_id: 1269750
description:
2026-01-30 23:04:29 dovecot_login authenticator failed for H=([27.123.114.130]) [27.123.114.130]:56428: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 23:04:36 dovecot_login authenticator failed for H=(frDagVYnG) [141.98.11.48]:55420: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.248.24.238
country_id: 798544
domain: lvconsult.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/lvconsultcom/public_html/wp-admin/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:04:23 dovecot_login authenticator failed for H=(uy4hOIL7Do) [2.58.56.77]:50160: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.22
country_id: 1269750
description:
2026-01-30 23:04:55 dovecot_login authenticator failed for H=([182.95.181.22]) [182.95.181.22]:57148: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:05:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:05:24 dovecot_login authenticator failed for H=(PEahVelau) [185.230.124.69]:64142: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.152.49.90
country_id: 1210997
description:
2026-01-30 23:05:28 dovecot_plain authenticator failed for H=(Q171B58071) [122.152.49.90]:5409: 535 Incorrect authentication data (set_id=abhan@euratech.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.222.95.178
country_id: 587116
description:
2026-01-30 23:05:35 1050005 [Warning] Aborted connection 1050005 to db: 'unconnected' user: 'unauthenticated' host: '185.222.95.178' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 23:05:07 dovecot_login authenticator failed for H=(Q9GyJbpPc) [141.98.11.48]:62427: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:05:08 dovecot_login authenticator failed for H=(vPmk2T5CBw) [2.58.56.77]:59715: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:05:29 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch@nexuscollection.com has been temporarily locked by Imunify PAM(2.58.56.77)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.48
country_id: 597427
description:
Jan 30 23:05:37 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch@nexuscollection.com has been temporarily locked by Imunify PAM(141.98.11.48)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.250.44.123
country_id: 1643084
description:
[2026-01-30 23:05:41 +0800] info [cpaneld] 180.250.44.123 - adssadadsa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user adssadadsa (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2026-01-30 23:05:03 dovecot_login authenticator failed for H=static-200-105-141-172.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.172]:39264: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 23:05:07 dovecot_login authenticator failed for H=(HNWr0y4Yc) [178.16.54.22]:52642: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:06:15 dovecot_login authenticator failed for H=(qtZKlS) [185.230.124.69]:52031: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:06:11 dovecot_login authenticator failed for H=(WLdnBHM52S) [2.58.56.77]:57143: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.176.229.36
country_id: 2017370
description:
2026-01-30 23:06:11 dovecot_login authenticator failed for H=([178.176.229.36]) [178.176.229.36]:49596: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:06:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 23:06:13 dovecot_login authenticator failed for H=(FhRxcZgzMj) [178.16.54.22]:53760: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.173.156.68
country_id: 1814991
description:
2026-01-30 23:06:03 dovecot_login authenticator failed for H=([61.173.156.68]) [61.173.156.68]:18696: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:06:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch@nexuscollection.com has been temporarily locked by Imunify PAM(2.58.56.77)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.48
country_id: 597427
description:
Jan 30 23:06:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch@nexuscollection.com has been temporarily locked by Imunify PAM(141.98.11.48)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 23:06:12 dovecot_login authenticator failed for H=(PvKS43fj6) [141.98.11.48]:51333: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:07:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch@nexuscollection.com has been temporarily locked by Imunify PAM(2.58.56.77)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:07:39 dovecot_login authenticator failed for H=(dpWzhzhhP) [185.230.124.69]:52822: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:07:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:07:18 dovecot_login authenticator failed for H=(NISxkQ) [2.58.56.77]:58314: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.48
country_id: 597427
description:
Jan 30 23:07:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch@nexuscollection.com has been temporarily locked by Imunify PAM(141.98.11.48)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 23:07:16 dovecot_login authenticator failed for H=(qyh89fth) [141.98.11.48]:57723: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.109.49.232
country_id: 1814991
description:
2026-01-30 23:07:19 dovecot_login authenticator failed for H=([223.109.49.232]) [223.109.49.232]:50026: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 23:07:25 dovecot_login authenticator failed for H=(8gNtDrQzY5) [178.16.54.22]:49936: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.246.106
country_id: 1269750
description:
2026-01-30 23:07:30 dovecot_login authenticator failed for H=([125.16.255.97]) [125.20.246.106]:60598: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:07:14 dovecot_login authenticator failed for H=(zOrIde) [185.230.124.69]:50259: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.48
country_id: 597427
description:
Jan 30 23:08:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch@nexuscollection.com has been temporarily locked by Imunify PAM(141.98.11.48)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2026-01-30 23:08:07 dovecot_login authenticator failed for H=([45.82.110.150]) [45.82.110.150]:33376: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:08:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:08:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch@nexuscollection.com has been temporarily locked by Imunify PAM(2.58.56.77)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 23:08:24 dovecot_login authenticator failed for H=(KcB4EsZ) [178.16.54.22]:64233: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:08:02 dovecot_login authenticator failed for H=(ZuAWUuR) [2.58.56.77]:59312: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 23:08:04 dovecot_login authenticator failed for H=(7a9xbzV7cE) [141.98.11.48]:51412: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:08:17 dovecot_login authenticator failed for H=(OgY0tP) [185.230.124.69]:52382: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2026-01-30 23:08:21 dovecot_login authenticator failed for H=([152.52.93.82]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 23:09:03 dovecot_login authenticator failed for H=(vdiZeZPmd) [178.16.54.22]:53800: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:09:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch@nexuscollection.com has been temporarily locked by Imunify PAM(2.58.56.77)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:09:05 dovecot_login authenticator failed for H=(RgVsKzuRg) [2.58.56.77]:50866: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.48
country_id: 597427
description:
Jan 30 23:09:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch@nexuscollection.com has been temporarily locked by Imunify PAM(141.98.11.48)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 23:09:13 dovecot_login authenticator failed for H=(JVmpWdC7Nz) [141.98.11.48]:51452: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:09:01 dovecot_login authenticator failed for H=(175CoslJTI) [185.230.124.69]:59018: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:10:30 dovecot_login authenticator failed for H=(M7vKGLXmE) [2.58.56.77]:60463: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:10:08 dovecot_login authenticator failed for H=(LOexAJB) [2.58.56.77]:49420: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-30 23:10:13 dovecot_login authenticator failed for H=(xp1oQjY) [178.16.54.22]:61791: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:10:18 dovecot_login authenticator failed for H=(cG0LO45gwV) [185.230.124.69]:57547: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:10:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch@nexuscollection.com has been temporarily locked by Imunify PAM(2.58.56.77)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-01-30 23:10:33 +0800] info [cpaneld] 185.204.54.153 - lnlfirep "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lnlfirep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.107.1
country_id: 1269750
description:
2026-01-30 23:10:41 dovecot_login authenticator failed for H=([144.24.107.1]) [144.24.107.1]:51274: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 23:10:53 dovecot_login authenticator failed for H=(keBviG) [141.98.11.48]:54088: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:11:17 dovecot_login authenticator failed for H=(B7yAuNEc) [2.58.56.77]:58398: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 23:11:18 dovecot_login authenticator failed for H=(miTmeb) [141.98.11.48]:53473: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:11:07 dovecot_login authenticator failed for H=(sXRSKCsae) [185.230.124.69]:63386: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.107.0.216
country_id: 1835841
description:
2026-01-30 23:11:15 dovecot_login authenticator failed for H=([118.60.136.49]) [183.107.0.216]:46340: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:12:26 dovecot_login authenticator failed for H=(5xnxR0ZI) [91.92.240.235]:62065: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:12:52 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account albertsim@essemgroup.net has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:12:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.120.149
country_id: 798549
description:
2026-01-30 23:12:20 dovecot_login authenticator failed for H=(ADMIN) [91.90.120.149]:55792: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:12:02 dovecot_login authenticator failed for H=(RoRSwk) [2.58.56.77]:54901: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.106.41.24
country_id: 3469034
description:
2026-01-30 23:12:27 dovecot_plain authenticator failed for H=(U289EEWT) [187.106.41.24]:19669: 535 Incorrect authentication data (set_id=rnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.50.119.110
country_id: 1814991
description:
2026-01-30 23:12:58 dovecot_login authenticator failed for H=(aoto.com.my) [61.50.119.110]:38254: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.221.219.16
country_id: 357994
description:
2026-01-30 23:12:22 dovecot_plain authenticator failed for H=(R9YP57Z8UQI) [156.221.219.16]:27349: 535 Incorrect authentication data (set_id=rohaidaak@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:12:06 dovecot_login authenticator failed for H=(3teICSGlp) [185.230.124.69]:55268: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 23:12:19 dovecot_login authenticator failed for H=(nc2zGRtsF) [141.98.11.48]:59666: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/symfony/translation/Tests/fixtures/resourcebundle/dat/resources.dat||User:visoftcom||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.10.89
country_id: 6252001
description:
[2026-01-30 23:13:54 +0800] info [webmaild] 65.111.10.89 - intercessors@agpc.org.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.222.120.45
country_id: 1269750
description:
2026-01-30 23:13:03 dovecot_login authenticator failed for H=(static.ill.117.247.82.240.bsnl.co.in) [117.222.120.45]:49726: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:13:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:13:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account albertsim@essemgroup.net has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:13:16 dovecot_login authenticator failed for H=(mFVm0glgz) [2.58.56.77]:53460: 535 Incorrect authentication data (set_id=albertsim@essemgroup.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 119.235.52.150
country_id: 1269750
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/gold/12/90/1260524 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:13:07 dovecot_login authenticator failed for H=(GPYooEm) [185.230.124.69]:57306: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.30.21
country_id: 1562822
description:
2026-01-30 23:13:12 dovecot_login authenticator failed for H=([27.71.30.21]) [27.71.30.21]:46328: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.50.119.110
country_id: 1814991
description:
2026-01-30 23:13:23 dovecot_login authenticator failed for H=(aoto.com.my) [61.50.119.110]:41950: 535 Incorrect authentication data (set_id=postmaster@aoto.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:13:13 dovecot_login authenticator failed for H=(15AL5UCwB) [2.58.56.77]:57457: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 23:13:30 dovecot_login authenticator failed for H=(8qYOzWg) [141.98.11.48]:65385: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:13:39 dovecot_login authenticator failed for H=(ePmHbdqDV7) [91.92.240.235]:51190: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 23:14:40 dovecot_login authenticator failed for H=(1F1NnO) [141.98.11.48]:55960: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:14:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account albertsim@essemgroup.net has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:14:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:14:07 dovecot_login authenticator failed for H=(X52CjTYXUI) [91.92.240.235]:63241: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:14:05 dovecot_login authenticator failed for H=(7LZwgYso) [185.230.124.69]:52717: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:14:05 dovecot_login authenticator failed for H=(Vmmy0m) [2.58.56.77]:49487: 535 Incorrect authentication data (set_id=albertsim@essemgroup.net)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 170.62.100.155
country_id: 2661886
description:
Jan 30 23:14:20 sv3 pure-ftpd[3527486]: (?@170.62.100.155) [INFO] New connection from 170.62.100.155


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 170.62.100.155
country_id: 2661886
description:
Jan 30 23:14:25 sv3 pure-ftpd[3527486]: (?@170.62.100.155) [WARNING] Authentication failed for user [oxboldc]


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:15:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account albertsim@essemgroup.net has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.105.22
country_id: 2363686
description:
2026-01-30 23:15:35 dovecot_plain authenticator failed for H=(58F1THHLM15) [196.171.105.22]:55243: 535 Incorrect authentication data (set_id=abhan@euratech.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:15:53 dovecot_login authenticator failed for H=(Ae0SQ1j) [2.58.56.77]:62060: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 23:15:05 dovecot_login authenticator failed for H=(msu0w27t1K) [141.98.11.48]:62450: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:15:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:15:20 dovecot_login authenticator failed for H=(tipOeG2) [91.92.240.235]:63997: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:15:15 dovecot_login authenticator failed for H=(gvXDCLmt) [185.230.124.69]:64592: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.48
country_id: 597427
description:
Jan 30 23:15:37 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(141.98.11.48)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:15:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(2.58.56.77)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:15:08 dovecot_login authenticator failed for H=(RmqjcOQP) [2.58.56.77]:60810: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:16:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:16:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account albertsim@essemgroup.net has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.141.143.58
country_id: 1835841
description:
2026-01-30 23:16:17 dovecot_login authenticator failed for H=([115.141.143.58]) [115.141.143.58]:37145: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.216.66
country_id: 1269750
description:
2026-01-30 23:16:27 dovecot_login authenticator failed for H=([182.66.234.193]) [125.19.216.66]:36212: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:16:29 dovecot_login authenticator failed for H=(ORtkReq) [91.92.240.235]:51713: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:16:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(2.58.56.77)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:16:14 dovecot_login authenticator failed for H=(yY73Zx6R) [2.58.56.77]:51134: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.48
country_id: 597427
description:
Jan 30 23:16:34 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(141.98.11.48)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 23:16:03 dovecot_login authenticator failed for H=(AZ893f) [141.98.11.48]:63353: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:16:04 dovecot_login authenticator failed for H=(Rwj9CcWl) [185.230.124.69]:51563: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:17:12 dovecot_login authenticator failed for H=(UnSl7RQVY) [185.230.124.69]:57685: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:17:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account albertsim@essemgroup.net has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.48
country_id: 597427
description:
Jan 30 23:17:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(141.98.11.48)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 23:17:09 dovecot_login authenticator failed for H=(pIwdgeq) [141.98.11.48]:61205: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:17:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(2.58.56.77)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:17:18 dovecot_login authenticator failed for H=(NGlwLur) [91.92.240.235]:53404: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:17:19 dovecot_login authenticator failed for H=(XaGx6SX9rm) [2.58.56.77]:64089: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.107.154.88
country_id: 2921044
description:
2026-01-30 23:17:03 dovecot_plain authenticator failed for H=static.88.154.107.91.clients.your-server.de (urban.my) [91.107.154.88]:43579: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.80.0.115
country_id: 6252001
description:
2026-01-30 23:18:16 dovecot_plain authenticator failed for H=ip-66-80-0-115.dsl.sca.megapath.net (localhost) [66.80.0.115]:60794: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.189.135.105
country_id: 1831722
description:
2026-01-30 23:18:08 dovecot_plain authenticator failed for H=(localhost) [203.189.135.105]:42407: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 23:18:31 dovecot_login authenticator failed for H=(Qgh4sW) [141.98.11.48]:49565: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.41.88
country_id: 1668284
description:
2026-01-30 23:18:40 dovecot_login authenticator failed for H=111-70-41-88.emome-ip.hinet.net [111.70.41.88]:50925: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:18:03 dovecot_login authenticator failed for H=(vY4uU9) [91.92.240.235]:65500: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.2.51.88
country_id: 1562822
description:
2026-01-30 23:18:30 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [117.2.51.88]:35590: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:18:32 dovecot_login authenticator failed for H=(04VUFcHdD4) [2.58.56.77]:54443: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:18:27 dovecot_login authenticator failed for H=(swoKhL) [185.230.124.69]:57458: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.172.118.10
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=951091 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:18:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(2.58.56.77)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:18:08 dovecot_login authenticator failed for H=(775DpiCIUi) [2.58.56.77]:57545: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.41
country_id: 690791
description:
2026-01-30 23:18:11 H=([45.144.212.41]) [45.144.212.41]:64196 F=<ash.zhang@ugslogistics.com> rejected RCPT <cklee@ktlog.com.my>: SPF: 45.144.212.41 is not allowed to send mail from ugslogistics.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:19:07 dovecot_login authenticator failed for H=(GyAiNG46) [2.58.56.77]:64718: 535 Incorrect authentication data (set_id=albertsim@essemgroup.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:19:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account munch has been temporarily locked by Imunify PAM(2.58.56.77)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:19:14 dovecot_login authenticator failed for H=(oqUgcL4o) [91.92.240.235]:64921: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:19:15 dovecot_login authenticator failed for H=(xBVxyAzHE) [185.230.124.69]:58382: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 23:19:27 dovecot_login authenticator failed for H=(DBVzf10nTK) [141.98.11.48]:49446: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:20:14 dovecot_login authenticator failed for H=(FnHX25) [2.58.56.77]:50194: 535 Incorrect authentication data (set_id=albertsim@essemgroup.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 135.237.126.209
country_id: 6252001
description:
2026-01-30 23:20:34 1050648 [Warning] Aborted connection 1050648 to db: 'unconnected' user: 'unauthenticated' host: '135.237.126.209' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:20:03 dovecot_login authenticator failed for H=(YAnfxQ5B1) [91.92.240.235]:65468: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 23:20:30 dovecot_login authenticator failed for H=(URunwkn) [141.98.11.48]:55441: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:20:26 dovecot_login authenticator failed for H=(VGEfxS2mkh) [185.230.124.69]:60384: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.66.162.153
country_id: 2361809
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/auntautumn/11/365/1196912 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:21:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:21:44 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account albertsim@essemgroup.net has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 23:21:05 dovecot_login authenticator failed for H=(KjOE6qH) [141.98.11.48]:49820: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:21:23 dovecot_login authenticator failed for H=(pT7MQhzrAK) [2.58.56.77]:50458: 535 Incorrect authentication data (set_id=albertsim@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:22:00 dovecot_login authenticator failed for H=(xjM1jeF) [91.92.240.235]:52607: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:21:11 dovecot_login authenticator failed for H=(0gD384) [2.58.56.77]:64157: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:21:15 dovecot_login authenticator failed for H=(aZLiOzR) [185.230.124.69]:63796: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.206.188.134
country_id: 357994
description:
2026-01-30 23:21:54 dovecot_plain authenticator failed for H=(Q171B58071) [156.206.188.134]:36421: 535 Incorrect authentication data (set_id=rnd@plomalite.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 30 23:21:58 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jb-sales has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.175.201.167
country_id: 3469034
description:
2026-01-30 23:23:00 dovecot_login authenticator failed for H=200.175.201.167.dynamic.dialup.gvt.net.br (corporate.static.gvt.net.br) [200.175.201.167]:57568: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:22:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account albertsim@essemgroup.net has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:22:02 dovecot_login authenticator failed for H=(e6UhdG3J) [185.230.124.69]:58115: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.183.102.189
country_id: 6252001
description:
2026-01-30 23:22:53 dovecot_login authenticator failed for H=(syn-075-183-102-189.res.spectrum.com) [75.183.102.189]:56521: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 30 23:22:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jb-sales has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:22:00 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 23:22:02 dovecot_login authenticator failed for H=(dbB0Rx) [141.98.11.48]:51485: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.200.42.112
country_id: 1880251
description:
2026-01-30 23:22:51 dovecot_login authenticator failed for H=(bb118-200-42-112.singnet.com.sg) [118.200.42.112]:41582: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.206.188.134
country_id: 357994
description:
2026-01-30 23:22:01 dovecot_login authenticator failed for H=(Q171B58071) [156.206.188.134]:36421: 535 Incorrect authentication data (set_id=rnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:22:06 dovecot_login authenticator failed for H=(9d0XkA6) [2.58.56.77]:51272: 535 Incorrect authentication data (set_id=albertsim@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:22:26 dovecot_login authenticator failed for H=(HIqC26) [91.92.240.235]:63637: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:23:07 dovecot_login authenticator failed for H=(rZFjGGS64C) [2.58.56.77]:52495: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:23:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 30 23:23:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jb-sales has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:23:17 dovecot_login authenticator failed for H=(EkHpqHUD) [91.92.240.235]:59023: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.146.78
country_id: 1835841
description:
2026-01-30 23:23:27 dovecot_login authenticator failed for H=([61.72.146.78]) [61.72.146.78]:51371: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 23:23:29 dovecot_login authenticator failed for H=(eUW79z1ze) [141.98.11.48]:53543: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:23:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account albertsim@essemgroup.net has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:23:55 dovecot_login authenticator failed for H=(O3jpbwXnCm) [2.58.56.77]:55051: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.37.150.6
country_id: 1835841
description:
2026-01-30 23:23:43 dovecot_login authenticator failed for H=([61.37.150.35]) [61.37.150.6]:45388: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:23:14 dovecot_login authenticator failed for H=(P2sj9gK0O) [185.230.124.69]:64981: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.48
country_id: 597427
description:
Jan 30 23:23:27 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 141.98.11.48


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 30 23:24:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jb-sales has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:24:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 23:24:24 dovecot_login authenticator failed for H=(qGlAcbwi) [141.98.11.48]:56699: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:24:15 dovecot_login authenticator failed for H=(lvos7ij9nu) [2.58.56.77]:63128: 535 Incorrect authentication data (set_id=albertsim@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.48
country_id: 597427
description:
Jan 30 23:24:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 141.98.11.48


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.248.24.238
country_id: 798544
domain: acburn.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/acburnco/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:24:06 dovecot_login authenticator failed for H=(HpNbn0E) [91.92.240.235]:57780: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:24:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account albertsim@essemgroup.net has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:24:23 dovecot_login authenticator failed for H=(JvDJtEDg2) [185.230.124.69]:65246: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 30 23:25:41 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jb-sales has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:25:43 dovecot_login authenticator failed for H=(6VYWek) [91.92.240.235]:61045: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:25:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:25:04 dovecot_login authenticator failed for H=(inJeuSH4) [2.58.56.77]:61712: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:25:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:25:13 dovecot_login authenticator failed for H=(X0id6AO4) [185.230.124.69]:63723: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.48
country_id: 597427
description:
Jan 30 23:25:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch@nexuscollection.com has been locked for the attacker IP 141.98.11.48


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-30 23:25:27 dovecot_login authenticator failed for H=(IYBLXWLY) [141.98.11.48]:63310: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:26:08 dovecot_login authenticator failed for H=(Ah8yqtc2) [91.92.240.235]:62289: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:26:34 dovecot_login authenticator failed for H=(J6WRRoCsZC) [2.58.56.77]:57938: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:26:08 dovecot_login authenticator failed for H=(CZJjOZLe) [2.58.56.77]:63455: 535 Incorrect authentication data (set_id=albertsim@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:26:03 dovecot_login authenticator failed for H=(Y4fXJe) [185.230.124.69]:54739: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:26:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account albertsim@essemgroup.net has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:27:16 dovecot_login authenticator failed for H=(Pn9RHuK) [2.58.56.77]:56073: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:27:23 dovecot_login authenticator failed for H=(hvtLwJ) [91.92.240.235]:61144: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:27:13 dovecot_login authenticator failed for H=(6iY0iGG6z) [185.230.124.69]:65214: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:27:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:28:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:28:03 dovecot_login authenticator failed for H=(PQHmEZ) [185.230.124.69]:60859: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.247.58
country_id: 3469034
description:
2026-01-30 23:28:37 dovecot_login authenticator failed for H=([186.238.157.140]) [187.9.247.58]:49131: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:28:07 dovecot_login authenticator failed for H=(ozyB39oJ4) [2.58.56.77]:61102: 535 Incorrect authentication data (set_id=albertsim@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:28:12 dovecot_login authenticator failed for H=(YC85JTJ) [91.92.240.235]:61100: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.181.3.22
country_id: 6252001
description:
2026-01-30 23:28:27 dovecot_login authenticator failed for H=(localhost.localdomain) [5.181.3.22]:56035: 535 Incorrect authentication data (set_id=info@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.89.205.24
country_id: 1605651
description:
2026-01-30 23:28:53 dovecot_login authenticator failed for H=mx-ll-183.89.205-24.dynamic.3bb.co.th [183.89.205.24]:38806: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:29:16 dovecot_login authenticator failed for H=(vmaklp) [2.58.56.77]:57349: 535 Incorrect authentication data (set_id=albertsim@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:29:23 dovecot_login authenticator failed for H=(cY6YD1GE) [91.92.240.235]:65096: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.2.140.186
country_id: 3469034
description:
2026-01-30 23:29:35 dovecot_login authenticator failed for H=(201-2-140-186.paemt704.e.brasiltelecom.net.br) [201.2.140.186]:59142: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.170.15
country_id: 3175395
description:
2026-01-30 23:29:36 dovecot_plain authenticator failed for H=([100.64.100.6]) [2.57.170.15]:1889: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:30:00 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:29:03 dovecot_login authenticator failed for H=(VKxWZ8K) [2.58.56.77]:59925: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.126.34.84
country_id: 2017370
description:
2026-01-30 23:29:08 dovecot_login authenticator failed for H=(109-126-34-84.pptp.vladlink.net) [109.126.34.84]:60010: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:29:12 dovecot_login authenticator failed for H=(v0T1uQPvsZ) [185.230.124.69]:55553: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.136.148.249
country_id: 99237
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/hotel.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:30:13 dovecot_login authenticator failed for H=(EOfu34) [91.92.240.235]:49979: 535 Incorrect authentication data (set_id=jb-sales)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/login.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:30:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
country_id: 6252001
description:
2026-01-30 23:30:48 dovecot_login authenticator failed for H=([50.217.255.171]) [50.217.255.171]:40785: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:30:02 dovecot_login authenticator failed for H=(NjRdXZ4QH) [185.230.124.69]:63146: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:30:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account albertsim@essemgroup.net has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.71.53.210
country_id: 1814991
description:
2026-01-30 23:30:51 dovecot_login authenticator failed for H=([117.71.53.210]) [117.71.53.210]:55740: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:30:02 dovecot_login authenticator failed for H=(Mzm9Q1) [2.58.56.77]:49829: 535 Incorrect authentication data (set_id=albertsim@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 30 23:30:57 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jb-sales has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2026-01-30 23:31:01 dovecot_login authenticator failed for H=([125.18.154.73]) [182.95.226.118]:44188: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.94.66
country_id: 1269750
description:
2026-01-30 23:31:19 dovecot_login authenticator failed for H=([27.123.94.66]) [27.123.94.66]:49694: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 30 23:31:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jb-sales has been locked for the attacker IP 91.92.240.235


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/contact.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.39.27.8
country_id: 1835841
description:
2026-01-30 23:31:09 dovecot_login authenticator failed for H=(devserver.gaonsoft.com) [118.39.27.8]:53366: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:31:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account albertsim@essemgroup.net has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:31:23 dovecot_login authenticator failed for H=(bzBVjvWIK6) [91.92.240.235]:56299: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:31:57 dovecot_login authenticator failed for H=(6zSl96) [2.58.56.77]:56974: 535 Incorrect authentication data (set_id=albertsim@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:31:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:31:05 dovecot_login authenticator failed for H=(n6ncAlqczI) [185.230.124.69]:61821: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:31:11 dovecot_login authenticator failed for H=(jEJxEC0) [2.58.56.77]:56226: 535 Incorrect authentication data (set_id=albertsim@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.48.93.218
country_id: 1814991
description:
2026-01-30 23:31:11 dovecot_login authenticator failed for H=(218.93.48.59.broad.jz.sx.dynamic.163data.com.cn) [59.48.93.218]:40049: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:32:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:32:15 dovecot_login authenticator failed for H=(vnVLsZp) [91.92.240.235]:56774: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:32:45 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:32:13 dovecot_login authenticator failed for H=(1EVYYlp0Ic) [185.230.124.69]:57763: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 30 23:32:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jb-sales has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:32:04 dovecot_login authenticator failed for H=(AVnGIclDka) [2.58.56.77]:49592: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:33:03 dovecot_login authenticator failed for H=(5FuFfnned) [185.230.124.69]:50114: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:33:05 dovecot_login authenticator failed for H=(KQWQJW) [91.92.240.235]:64960: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:33:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:33:10 dovecot_login authenticator failed for H=(6ZLq1i) [2.58.56.77]:60095: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:33:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 30 23:33:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jb-sales has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.156.152.152
country_id: 732800
description:
2026-01-30 23:33:46 H=([94.156.152.152]) [94.156.152.152]:49789 F=<altawashtrading_15@yahoo.com> rejected RCPT <corporate_ch@ajplantations.com.my>: No Such User Here"


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:34:42 dovecot_login authenticator failed for H=(3Tm8si) [2.58.56.77]:49514: 535 Incorrect authentication data (set_id=albertsim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:34:11 dovecot_login authenticator failed for H=(KceEzv) [185.230.124.69]:55094: 535 Incorrect authentication data (set_id=arahman@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:34:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:34:20 dovecot_login authenticator failed for H=(d7qLqMx9a) [2.58.56.77]:58979: 535 Incorrect authentication data (set_id=albertsim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.81.142.55
country_id: 3996063
description:
2026-01-30 23:34:33 dovecot_login authenticator failed for H=(ADMIN) [77.81.142.55]:57207: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 30 23:34:37 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jb-sales has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:34:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:34:39 dovecot_login authenticator failed for H=(ok4M6x18) [91.92.240.235]:51670: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:35:03 dovecot_login authenticator failed for H=(d6NACzdtr) [91.92.240.235]:51928: 535 Incorrect authentication data (set_id=jb-sales)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 171.243.58.135
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=22861516002507 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:35:20 dovecot_login authenticator failed for H=(qvbdY7G0) [185.230.124.69]:53459: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:35:06 dovecot_login authenticator failed for H=(PzOP4KV) [2.58.56.77]:63452: 535 Incorrect authentication data (set_id=munch)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/esg.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 30 23:35:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jb-sales has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:35:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account munch has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 151.240.205.206
country_id: 6252001
domain: www.inter-link.edu.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/89.0.4389.90 Safari/537.36||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:36:15 dovecot_login authenticator failed for H=(AfkEDbT) [2.58.56.77]:49730: 535 Incorrect authentication data (set_id=albertsim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.98.63.199
country_id: 1269750
description:
2026-01-30 23:36:30 dovecot_plain authenticator failed for H=(LF21D45A3WC8) [103.98.63.199]:3525: 535 Incorrect authentication data (set_id=rohaidaak@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:36:04 dovecot_login authenticator failed for H=(92LXpzEQV) [185.230.124.69]:61324: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:36:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account albertsim has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:36:23 dovecot_login authenticator failed for H=(xUir0PP111) [91.92.240.235]:62694: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.202
country_id: 1149361
description:
2026-01-30 23:37:09 dovecot_login authenticator failed for H=([180.94.75.202]) [180.94.75.202]:49441: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:37:14 dovecot_login authenticator failed for H=(q5zvas) [91.92.240.235]:56626: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:37:17 dovecot_login authenticator failed for H=(ohiuDO1liw) [185.230.124.69]:54997: 535 Incorrect authentication data (set_id=arahman@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:37:20 dovecot_login authenticator failed for H=(WlcomK) [185.230.124.69]:61352: 535 Incorrect authentication data (set_id=andrew.chin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:37:27 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account albertsim has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:37:39 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account arahman@ocned.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.38.0.41
country_id: 6252001
description:
2026-01-30 23:37:17 dovecot_login authenticator failed for H=([45.38.0.41]) [45.38.0.41]:3750: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.245.170.65
country_id: 1227603
description:
2026-01-30 23:37:18 dovecot_plain authenticator failed for H=(LE7AQH53ZALJ4) [61.245.170.65]:36665: 535 Incorrect authentication data (set_id=rohaidaak@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:37:29 dovecot_login authenticator failed for H=(F5qHlBW) [2.58.56.77]:51864: 535 Incorrect authentication data (set_id=albertsim)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.128.35
country_id: 1880251
domain: fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/storage.googleapis.com/tainew_com/v1/img/top/events.php||SC:/home2/fkrcom/public_html/storage.googleapis.com||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.52.32.226
country_id: 1733045
description:
[2026-01-30 23:38:18 +0800] info [webmaild] 60.52.32.226 - kwangpeng@ktlog.com.my "GET /cpsess6190763886/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.59.26
country_id: 1269750
description:
2026-01-30 23:38:03 dovecot_login authenticator failed for H=([125.23.125.209]) [122.187.59.26]:33848: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:38:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account albertsim has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.247.22.181
country_id: 1835841
description:
2026-01-30 23:38:15 dovecot_login authenticator failed for H=([106.247.22.181]) [106.247.22.181]:38997: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:38:16 dovecot_login authenticator failed for H=(k6CVY7) [2.58.56.77]:64289: 535 Incorrect authentication data (set_id=albertsim)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:38:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account arahman@ocned.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:38:06 dovecot_login authenticator failed for H=(XGsw1yvqdN) [185.230.124.69]:58973: 535 Incorrect authentication data (set_id=arahman@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:39:07 dovecot_login authenticator failed for H=(XUnTvG) [91.92.240.235]:63857: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:39:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account arahman@ocned.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.164.148.87
country_id: 1512440
description:
2026-01-30 23:39:13 dovecot_login authenticator failed for H=([62.164.148.87]) [62.164.148.87]:50708: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:39:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account albertsim has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:39:18 dovecot_login authenticator failed for H=(7uxTGL) [2.58.56.77]:58087: 535 Incorrect authentication data (set_id=albertsim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:39:10 dovecot_login authenticator failed for H=(IOahYUn) [185.230.124.69]:57788: 535 Incorrect authentication data (set_id=arahman@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.170.15
country_id: 3175395
description:
2026-01-30 23:39:14 dovecot_plain authenticator failed for H=([100.64.100.6]) [2.57.170.15]:21111: 535 Incorrect authentication data (set_id=fasya@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.22.153
country_id: 1668284
description:
2026-01-30 23:39:27 dovecot_login authenticator failed for H=111-70-22-153.emome-ip.hinet.net [111.70.22.153]:49286: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-30 23:40:04 dovecot_login authenticator failed for H=(WufRazxmqc) [69.5.189.21]:54165: 535 Incorrect authentication data (set_id=miner_sandy@imax.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:40:28 dovecot_login authenticator failed for H=(KEfe5i) [185.230.124.69]:52885: 535 Incorrect authentication data (set_id=andrew.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:40:21 dovecot_login authenticator failed for H=(wa0toIJT) [91.92.240.235]:55779: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:40:26 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:40:02 dovecot_login authenticator failed for H=(wZZ2cLp) [2.58.56.77]:49424: 535 Incorrect authentication data (set_id=albertsim)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:40:03 dovecot_login authenticator failed for H=(ptEI5L) [185.230.124.69]:54716: 535 Incorrect authentication data (set_id=andrew.chin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:40:27 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account albertsim has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:41:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/languages/images/sliders/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 30 23:41:30 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jb-sales has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-30 23:41:15 dovecot_login authenticator failed for H=(JifAkylBh) [69.5.189.21]:50119: 535 Incorrect authentication data (set_id=miner_sandy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:41:18 dovecot_login authenticator failed for H=(Xd6xC5G) [185.230.124.69]:59979: 535 Incorrect authentication data (set_id=andrew.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.216.89.122
country_id: 1814991
description:
2026-01-30 23:41:28 dovecot_login authenticator failed for H=([60.216.89.122]) [60.216.89.122]:48302: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:41:17 dovecot_login authenticator failed for H=(8SNc8CV) [2.58.56.77]:56267: 535 Incorrect authentication data (set_id=albertsim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.173.121.100
country_id: 1814991
description:
2026-01-30 23:41:18 dovecot_login authenticator failed for H=([180.173.121.100]) [180.173.121.100]:35200: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:41:32 dovecot_login authenticator failed for H=(5AZ1U6T) [91.92.240.235]:56837: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-30 23:42:01 dovecot_login authenticator failed for H=(DW1jSQHM) [69.5.189.21]:57416: 535 Incorrect authentication data (set_id=miner_sandy@imax.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:42:21 dovecot_login authenticator failed for H=(z5mg6dd) [91.92.240.235]:50525: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-01-30 23:42:36 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:53452: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:42:00 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.76.126
country_id: 1149361
description:
2026-01-30 23:42:50 dovecot_login authenticator failed for H=([180.94.76.126]) [180.94.76.126]:35416: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:42:02 dovecot_login authenticator failed for H=(t8dsSlzH0q) [185.230.124.69]:51718: 535 Incorrect authentication data (set_id=andrew.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.61.176.110
country_id: 3469034
description:
2026-01-30 23:42:27 dovecot_login authenticator failed for H=([187.50.122.20]) [177.61.176.110]:54646: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.175.75
country_id: 99237
description:
2026-01-30 23:42:49 dovecot_login authenticator failed for H=([65.20.175.75]) [65.20.175.75]:40684: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:42:01 dovecot_login authenticator failed for H=(ivsEwp) [2.58.56.77]:63366: 535 Incorrect authentication data (set_id=albertsim)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 30 23:42:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jb-sales has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2026-01-30 23:42:07 dovecot_login authenticator failed for H=(nsg-corporate-126.176.185.122.airtel.in) [122.185.176.126]:33100: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:43:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.19.12
country_id: 3144096
description:
2026-01-30 23:43:02 dovecot_login authenticator failed for H=(cm-84.211.19.12.get.no) [84.211.19.12]:44599: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:43:45 dovecot_login authenticator failed for H=(t61TrkO) [185.230.124.69]:50980: 535 Incorrect authentication data (set_id=arahman@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 30 23:43:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jb-sales has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:43:08 dovecot_login authenticator failed for H=(l0C2cdeA) [2.58.56.77]:52310: 535 Incorrect authentication data (set_id=albertsim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:43:09 dovecot_login authenticator failed for H=(nCMCIoOQ) [91.92.240.235]:49662: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-30 23:43:13 dovecot_login authenticator failed for H=(XVkV4JW) [69.5.189.21]:53065: 535 Incorrect authentication data (set_id=miner_sandy)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.83.18
country_id: 1562822
domain: aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aoto.com.my/product-detail.php?id=5080364288 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:43:01 dovecot_login authenticator failed for H=(jC9bm1) [185.230.124.69]:55076: 535 Incorrect authentication data (set_id=arahman@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-30 23:44:23 dovecot_login authenticator failed for H=(YyaRLn) [69.5.189.21]:64285: 535 Incorrect authentication data (set_id=miner_sandy@imax.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:44:02 dovecot_login authenticator failed for H=(G4lelwYYXp) [91.92.240.235]:60645: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:44:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:44:17 dovecot_login authenticator failed for H=(aSj29Y) [2.58.56.77]:60890: 535 Incorrect authentication data (set_id=albertsim)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:44:36 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account albertsim has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 30 23:44:00 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jb-sales has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:44:04 dovecot_login authenticator failed for H=(t9pAqC7nk) [185.230.124.69]:50756: 535 Incorrect authentication data (set_id=arahman@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:45:59 dovecot_login authenticator failed for H=(KqwVdZ) [91.92.240.235]:54733: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:45:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account albertsim has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:45:04 dovecot_login authenticator failed for H=(SPBPep8B7z) [2.58.56.77]:62669: 535 Incorrect authentication data (set_id=albertsim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-30 23:45:10 dovecot_login authenticator failed for H=(kgrcKoKwD9) [69.5.189.21]:56022: 535 Incorrect authentication data (set_id=miner_sandy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:45:18 dovecot_login authenticator failed for H=(3oA4LaoU0) [185.230.124.69]:62298: 535 Incorrect authentication data (set_id=andrew.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:46:15 dovecot_login authenticator failed for H=(wJhljf2uY) [2.58.56.77]:52182: 535 Incorrect authentication data (set_id=albertsim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:46:23 dovecot_login authenticator failed for H=(Ik0H9N) [91.92.240.235]:55513: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:46:32 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account arahman@ocned.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:46:34 dovecot_login authenticator failed for H=(G1U1Nmv) [185.230.124.69]:62723: 535 Incorrect authentication data (set_id=arahman@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.98.68.199
country_id: 1835841
description:
2026-01-30 23:46:52 dovecot_login authenticator failed for H=([183.98.68.199]) [183.98.68.199]:56908: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:46:08 dovecot_login authenticator failed for H=(Tp6qU6) [185.230.124.69]:49910: 535 Incorrect authentication data (set_id=andrew.chin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:46:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account albertsim has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:47:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account arahman@ocned.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:47:19 dovecot_login authenticator failed for H=(8ZQLWz) [185.230.124.69]:52433: 535 Incorrect authentication data (set_id=arahman@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:47:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account albertsim has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:47:01 dovecot_login authenticator failed for H=(dRZHGs3S) [2.58.56.77]:61820: 535 Incorrect authentication data (set_id=albertsim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:47:54 dovecot_login authenticator failed for H=(2t1Kz7W) [91.92.240.235]:63943: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:48:09 dovecot_login authenticator failed for H=(4M5hBbzH25) [185.230.124.69]:64726: 535 Incorrect authentication data (set_id=arahman@ocned.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/symfony/translation/Tests/fixtures/resources.ini||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.224.93
country_id: 337996
description:
2026-01-30 23:48:15 dovecot_plain authenticator failed for H=(398XN2FAL8) [196.189.224.93]:36050: 535 Incorrect authentication data (set_id=payment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:48:18 dovecot_login authenticator failed for H=(M3poLM3) [91.92.240.235]:65226: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:48:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account arahman@ocned.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:48:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account albertsim has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:48:12 dovecot_login authenticator failed for H=(XGmd9K8l) [2.58.56.77]:52739: 535 Incorrect authentication data (set_id=albertsim)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:48:39 dovecot_login authenticator failed for H=(xbL3B8qyB) [185.230.124.69]:53289: 535 Incorrect authentication data (set_id=andrew.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:49:21 dovecot_login authenticator failed for H=(TdcidOMN) [2.58.56.77]:51081: 535 Incorrect authentication data (set_id=albertsim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:49:04 dovecot_login authenticator failed for H=(61OwJ3tcZ8) [185.230.124.69]:55640: 535 Incorrect authentication data (set_id=andrew.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:49:09 dovecot_login authenticator failed for H=(4YshbT) [91.92.240.235]:56024: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:49:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account arahman@ocned.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2026-01-30 23:49:48 dovecot_login authenticator failed for H=([83.136.176.12]) [83.136.176.12]:36369: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2026-01-30 23:49:56 dovecot_login authenticator failed for H=syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:56484: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.187.65.135
country_id: 1814991
description:
2026-01-30 23:50:37 dovecot_login authenticator failed for H=([118.187.65.135]) [118.187.65.135]:51492: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.2.123.19
country_id: 1562822
description:
2026-01-30 23:50:47 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [117.2.123.19]:58888: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.59.26
country_id: 1269750
description:
2026-01-30 23:50:06 dovecot_login authenticator failed for H=([125.23.125.209]) [122.187.59.26]:38910: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.59.6.81
country_id: 1668284
description:
2026-01-30 23:50:19 dovecot_login authenticator failed for H=(h81-61-59-6.seed.net.tw) [61.59.6.81]:59366: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:50:38 dovecot_login authenticator failed for H=(3ZkhsmPgJd) [185.230.124.69]:53818: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 30 23:50:49 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jb-sales has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:50:13 dovecot_login authenticator failed for H=(FshEYQold) [185.230.124.69]:50838: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:50:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account arahman@ocned.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:50:06 dovecot_login authenticator failed for H=(l82fak4i) [2.58.56.77]:58805: 535 Incorrect authentication data (set_id=albertsim)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.217.213.144
country_id: 3996063
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=95561520648895 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:50:01 dovecot_login authenticator failed for H=(fSJNFZ339a) [91.92.240.235]:50323: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2026-01-30 23:52:00 dovecot_plain authenticator failed for H=(troarisost) [65.20.133.208]:59083: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:51:02 dovecot_login authenticator failed for H=(q16NjZ3f6) [185.230.124.69]:54707: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:51:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.205.47.222
country_id: 1269750
description:
2026-01-30 23:51:10 dovecot_plain authenticator failed for H=(U289EEWT) [49.205.47.222]:61417: 535 Incorrect authentication data (set_id=payment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:51:11 dovecot_login authenticator failed for H=(dsLPt71BA) [2.58.56.77]:54283: 535 Incorrect authentication data (set_id=albertsim)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 30 23:51:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jb-sales has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:51:15 dovecot_login authenticator failed for H=(VvcBi2y) [91.92.240.235]:57397: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:52:04 dovecot_login authenticator failed for H=(8BoWf7) [185.230.124.69]:49407: 535 Incorrect authentication data (set_id=andrew.chin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 30 23:52:46 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jb-sales has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:52:23 dovecot_login authenticator failed for H=(Yu8vmp) [2.58.56.77]:57747: 535 Incorrect authentication data (set_id=albertsim)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:52:31 dovecot_login authenticator failed for H=(azuyt5MO) [185.230.124.69]:59712: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:52:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:52:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account albertsim has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:52:48 dovecot_login authenticator failed for H=(fN3eaJy2) [91.92.240.235]:62604: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.76.248.54
country_id: 1814991
description:
2026-01-30 23:54:00 dovecot_login authenticator failed for H=([222.76.248.54]) [222.76.248.54]:37272: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 30 23:53:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jb-sales has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-01-30 23:53:17 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:33688: 535 Incorrect authentication data (set_id=zulkifli.abdul-mutalib@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.29.231.106
country_id: 1814991
description:
2026-01-30 23:53:44 dovecot_login authenticator failed for H=(hn.kd.ny.adsl) [218.29.231.106]:53184: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:53:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:53:12 dovecot_login authenticator failed for H=(o91sW6e) [91.92.240.235]:63491: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:53:16 dovecot_login authenticator failed for H=(H5mQcYP) [185.230.124.69]:57443: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:53:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account albertsim has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:53:08 dovecot_login authenticator failed for H=(AZ1XYqS) [2.58.56.77]:54181: 535 Incorrect authentication data (set_id=albertsim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.166.226.235
country_id: 1643084
description:
2026-01-30 23:53:52 dovecot_login authenticator failed for H=([103.166.226.235]) [103.166.226.235]:38114: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:54:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:54:02 dovecot_login authenticator failed for H=(4aVLAR) [91.92.240.235]:50875: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2026-01-30 23:54:03 dovecot_login authenticator failed for H=69-172-79-198.static.imsbiz.com (173-248-234-145.static.imsbiz.com) [69.172.79.198]:49848: 535 Incorrect authentication data (set_id=zulkifli.abdul-mutalib)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.87.152
country_id: 1814991
description:
2026-01-30 23:54:03 dovecot_login authenticator failed for H=([111.61.87.152]) [111.61.87.152]:36094: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 30 23:54:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account albertsim has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-01-30 23:54:14 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:36960: 535 Incorrect authentication data (set_id=project@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:54:04 dovecot_login authenticator failed for H=(px5SDeIgqw) [185.230.124.69]:52245: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 91.92.240.235
country_id: 2921044
description:
Jan 30 23:54:26 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jb-sales has been locked for the attacker IP 91.92.240.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-30 23:54:14 dovecot_login authenticator failed for H=(PyDnNu) [2.58.56.77]:63530: 535 Incorrect authentication data (set_id=albertsim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.145.5.14
country_id: 1835841
description:
2026-01-30 23:54:59 dovecot_login authenticator failed for H=([221.145.5.14]) [221.145.5.14]:54483: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:55:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:55:23 dovecot_login authenticator failed for H=(pBOBCjF) [185.230.124.69]:49626: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-30 23:55:02 H=(localhost.localdomain) [78.153.140.207]:49996 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:55:17 dovecot_login authenticator failed for H=(7CuAJ51aYo) [185.230.124.69]:55386: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:55:39 dovecot_login authenticator failed for H=(V6mhHpJiew) [91.92.240.235]:55290: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2026-01-30 23:55:08 dovecot_login authenticator failed for H=([50.217.40.11]) [50.217.40.11]:43634: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:56:25 dovecot_login authenticator failed for H=(TNUjqVZj7c) [91.92.240.235]:59560: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.47
country_id: 6252001
description:
2026-01-30 23:56:33 dovecot_login authenticator failed for H=(ADMIN) [173.244.56.47]:46693: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:56:03 dovecot_login authenticator failed for H=(193nBWpzid) [185.230.124.69]:50744: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:56:52 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.219.24.104
country_id: 1269750
domain: ajplantations.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/ajpl3424/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:57:19 dovecot_login authenticator failed for H=(K5lus0j) [185.230.124.69]:57187: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:57:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.240.235
country_id: 2921044
description:
2026-01-30 23:57:16 dovecot_login authenticator failed for H=(0ZTb1qt) [91.92.240.235]:54515: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.13.71.126
country_id: 1814991
description:
2026-01-30 23:57:59 dovecot_login authenticator failed for H=(hn.kd.ny.adsl) [123.13.71.126]:6630: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-01-30 23:58:23 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:63266: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.61
country_id: 6252001
description:
Jan 30 23:58:05 sv3 pure-ftpd[3561217]: (?@147.185.132.61) [INFO] New connection from 147.185.132.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.50
country_id: 1269750
description:
2026-01-30 23:58:06 dovecot_login authenticator failed for H=([125.16.246.121]) [182.95.63.50]:37084: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:58:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2026-01-30 23:58:09 dovecot_plain authenticator failed for H=(lodon) [24.105.248.218]:38992: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:58:09 dovecot_login authenticator failed for H=(1p1pnt0Ez) [185.230.124.69]:62704: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:58:11 dovecot_login authenticator failed for H=(maCt7mz7) [185.230.124.69]:63936: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2026-01-30 23:59:07 dovecot_login authenticator failed for H=([83.239.84.130]) [83.239.84.130]:60572: 535 Incorrect authentication data (set_id=hafizi)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 30 23:59:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-30 23:59:16 dovecot_login authenticator failed for H=(iYQQTSgkO) [185.230.124.69]:55572: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-30 23:59:57 dovecot_login authenticator failed for H=(CBJyLgncOF) [158.94.208.175]:62763: 535 Incorrect authentication data (set_id=plsu.fpp)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:00:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account andrew.chin@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:00:07 dovecot_login authenticator failed for H=(EtXB9enFl) [185.230.124.69]:51579: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:00:26 dovecot_login authenticator failed for H=(YmkXGCs) [158.94.208.175]:60709: 535 Incorrect authentication data (set_id=plsu.fpp)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:00:59 dovecot_login authenticator failed for H=(eQxoNDexBd) [185.230.124.69]:55135: 535 Incorrect authentication data (set_id=andrew.chin@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 158.158.35.58
country_id: 2510769
domain: www.mams1.manforce.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home/manfotp3/mams1.manforce.net/wp-admin||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 139.162.70.53
country_id: 1861060
description:
2026-01-31  0:00:17 573 [Warning] Aborted connection 573 to db: 'unconnected' user: 'unauthenticated' host: '139.162.70.53' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/demos/new-development.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:01:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.44.157
country_id: 1814991
domain: www.manforce.net
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.163.31
country_id: 1814991
domain: www.manforce.net
description:


